* Returns a sanitized copy of the global variables namespace when sandboxed. * * This filters out the TicketSalt variable specifically and any variable for which the * PermChecker does not return 'true'. * * However it specifically keeps the Types, System, and Icinga sub-namespaces, because they're * accessed through globals in ScopeExpression and the user should have access to all Values *
| 105 | * @return a sanitized copy of the global namespace if sandboxed, a pointer to the global namespace otherwise. |
| 106 | */ |
| 107 | Namespace::Ptr ScriptFrame::GetGlobals() |
| 108 | { |
| 109 | if (Sandboxed) { |
| 110 | if (!Globals) { |
| 111 | Globals = new Namespace; |
| 112 | auto globals = ScriptGlobal::GetGlobals(); |
| 113 | ObjectLock lock{globals}; |
| 114 | for (auto& [key, val] : globals) { |
| 115 | if (key == "TicketSalt") { |
| 116 | continue; |
| 117 | } |
| 118 | |
| 119 | if (key == "Types" || key == "System" || key == "Icinga" || PermChecker->CanAccessGlobalVariable(key)) { |
| 120 | Globals->Set(key, val.Val, val.Const); |
| 121 | } |
| 122 | } |
| 123 | } |
| 124 | return Globals; |
| 125 | } |
| 126 | |
| 127 | return ScriptGlobal::GetGlobals(); |
| 128 | } |
| 129 | |
| 130 | void ScriptFrame::IncreaseStackDepth() |
| 131 | { |
no test coverage detected