Update README.md

README.md

@@ -159,5 +159,5 @@ To ensure security, only a limited set of safe functions are exposed in Lua hook
 
 # TODO
 
-- Auto upgrade all packages available
-- Packets Universe
+- Auto-compile packages
+- An web page to upload packages

cmd/packets/main.go

@@ -99,6 +99,8 @@ type Manifest struct {
 	} `toml:"Hooks"`
 }
 
+const LANDeadLine = 2 * time.Second
+
 // errors
 
 var ErrNotInstalled = errors.New("this package isn't installed")
@@ -672,6 +674,7 @@ func Install(packagepath string, serial uint) error {
 
 		L.SetGlobal("package", lua.LNil)
 		L.SetGlobal("require", lua.LNil)
+		L.SetGlobal("runningUnsafe", lua.LFalse)
 
 		L.SetGlobal("packets_package_dir", lua.LString(cfg.Config.DataDir))
 		L.SetGlobal("packets_bin_dir", lua.LString(cfg.Config.BinDir))
@@ -707,6 +710,8 @@ func Install(packagepath string, serial uint) error {
 		ioObject.RawSetString("stdin", lua.LNil)
 		ioObject.RawSetString("lines", lua.LNil)
 		ioObject.RawSetString("open", L.NewFunction(internal.SafeOpen))
+	} else {
+		L.SetGlobal("runningUnsafe", lua.LTrue)
 	}
 
 	if err := L.DoFile(filepath.Join(cfg.Config.DataDir, name, manifest.Hooks.Install)); err != nil {
@@ -1106,7 +1111,7 @@ func AskLAN(filename string) []Peer {
 			}
 		}
 	}
-	_ = pc.SetDeadline(time.Now().Add(2 * time.Second))
+	_ = pc.SetDeadline(time.Now().Add(LANDeadLine))
 	buf := make([]byte, 1500)
 
 	for {
@@ -1360,6 +1365,7 @@ func Unninstall(realname string) error {
 
 		L.SetGlobal("package", lua.LNil)
 		L.SetGlobal("require", lua.LNil)
+		L.SetGlobal("runningUnsafe", lua.LFalse)
 
 		L.SetGlobal("packets_package_dir", lua.LString(cfg.Config.DataDir))
 		L.SetGlobal("packets_bin_dir", lua.LString(cfg.Config.BinDir))
@@ -1396,6 +1402,8 @@ func Unninstall(realname string) error {
 		ioObject.RawSetString("lines", lua.LNil)
 		ioObject.RawSetString("open", L.NewFunction(internal.SafeOpen))
 
+	} else {
+		L.SetGlobal("runningUnsafe", lua.LTrue)
 	}
 
 	if err := L.DoFile(filepath.Join(cfg.Config.DataDir, realname, manifest.Hooks.Remove)); err != nil {
@@ -1426,6 +1434,11 @@ func AlredySatisfied(realname string) error {
 
 	var exist bool
 
+	_, err = db.Exec("CREATE TABLE IF NOT EXISTS packages (realname TEXT NOT NULL UNIQUE PRIMARY KEY, version TEXT NOT NULL, dependencies TEXT, name TEXT, family TEXT NOT NULL, serial INTEGER)")
+	if err != nil {
+		return err
+	}
+
 	err = db.QueryRow("SELECT EXISTS(SELECT 1 FROM packages WHERE realname = ?  LIMIT 1)", realname).Scan(&exist)
 	if err != nil {
 		return err
@@ -1680,6 +1693,7 @@ func Upgrade(packagepath string, og_realname string, serial uint) error {
 
 		L.SetGlobal("package", lua.LNil)
 		L.SetGlobal("require", lua.LNil)
+		L.SetGlobal("runningUnsafe", lua.LFalse)
 
 		L.SetGlobal("packets_package_dir", lua.LString(cfg.Config.DataDir))
 		L.SetGlobal("packets_bin_dir", lua.LString(cfg.Config.BinDir))
@@ -1696,6 +1710,8 @@ func Upgrade(packagepath string, og_realname string, serial uint) error {
 
 		L.SetGlobal("build", build)
 
+		// end of build functions
+
 		osObject.RawSetString("execute", lua.LNil)
 		osObject.RawSetString("exit", lua.LNil)
 		osObject.RawSetString("getenv", lua.LNil)
@@ -1715,6 +1731,8 @@ func Upgrade(packagepath string, og_realname string, serial uint) error {
 		ioObject.RawSetString("stdin", lua.LNil)
 		ioObject.RawSetString("lines", lua.LNil)
 		ioObject.RawSetString("open", L.NewFunction(internal.SafeOpen))
+	} else {
+		L.SetGlobal("runningUnsafe", lua.LTrue)
 	}
 
 	if err := L.DoFile(filepath.Join(cfg.Config.DataDir, name, manifest.Hooks.Install)); err != nil {

docs/examples/package.lua

@@ -0,0 +1 @@
+-- PACKETS SCRIPTS EXAMPLES

internal/internal.go

@@ -443,11 +443,13 @@ func LMkdir(L *lua.LState) int {
 	if !IsSafe(path) {
 		L.Push(lua.LFalse)
 		L.Push(lua.LString("[packets] unsafe filepath\n"))
+		return 2
 	}
 
 	if err := os.MkdirAll(path, os.FileMode(perm)); err != nil {
 		L.Push(lua.LFalse)
 		L.Push(lua.LString("[packets] mkdir failed\n" + err.Error()))
+		return 2
 	}
 
 	L.Push(lua.LTrue)
@@ -462,13 +464,16 @@ func LuaCompile(L *lua.LState) int {
 
 		if strings.Contains(L.CheckString(i), "/") {
 
-			tryintoacess, err := filepath.Abs(filepath.Clean(L.CheckString(i)))
+			tryintoacess, err := filepath.Abs(filepath.Clean(filepath.Join(SandboxDir, L.CheckString(i))))
 			if err != nil {
 				L.Push(lua.LFalse)
 				L.Push(lua.LString("[packets] invalid filepath\n" + err.Error()))
 				return 2
 			}
-			if !strings.HasPrefix(tryintoacess, SandboxDir) {
+
+			fmt.Printf("sandboxdir: (%s) acessto: (%s)\n", SandboxDir, tryintoacess)
+			rel, err := filepath.Rel(SandboxDir, tryintoacess)
+			if err != nil || strings.HasPrefix(rel, "..") {
 				L.Push(lua.LFalse)
 				L.Push(lua.LString("[packets] unsafe filepath"))
 				return 2