some security fixes for fluxbox-remote, and a minor change for the gvim fix

1 files changed, 4 insertions, 3 deletions

diff --git a/src/Screen.cc b/src/Screen.cc
index 68f928b..dfa986e 100644
--- a/src/Screen.cc
+++ b/src/Screen.cc
@@ -326,6 +326,7 @@ BScreen::ScreenResource::ScreenResource(FbTk::ResourceManager &rm,
                  altscrname+".overlay.CapStyle"),
     scroll_action(rm, "", scrname+".windowScrollAction", altscrname+".WindowScrollAction"),
     scroll_reverse(rm, false, scrname+".windowScrollReverse", altscrname+".WindowScrollReverse"),
+    allow_remote_actions(rm, false, scrname+".allowRemoteActions", altscrname+".AllowRemoteActions"),
     max_over_tabs(rm, false, scrname+".tabs.maxOver", altscrname+".Tabs.MaxOver"),
     default_internal_tabs(rm, true /* TODO: autoconf option? */ , scrname+".tabs.intitlebar", altscrname+".Tabs.InTitlebar") {
 
@@ -785,8 +786,8 @@ void BScreen::update(FbTk::Subject *subj) {
 
 void BScreen::propertyNotify(Atom atom) {
     static Atom fbcmd_atom = XInternAtom(FbTk::App::instance()->display(),
-                                         "_FLUXBOX_COMMAND", False);
-    if (atom == fbcmd_atom) {
+                                         "_FLUXBOX_ACTION", False);
+    if (allowRemoteActions() && atom == fbcmd_atom) {
         Atom xa_ret_type;
         int ret_format;
         unsigned long ret_nitems, ret_bytes_after;
@@ -803,7 +804,7 @@ void BScreen::propertyNotify(Atom atom) {
                     &ret_bytes_after, (unsigned char **)&str);
             }
 
-            FbTk::RefCount<FbTk::Command> cmd(CommandParser::instance().parseLine(str));
+            FbTk::RefCount<FbTk::Command> cmd(CommandParser::instance().parseLine(str, false));
             if (cmd.get())
                 cmd->execute();
             XFree(str);