New "Running scripts could compromise..." warning

[maqjav]

Hello.

In my addon I'm using the next script to target and mark a NPC.

self:SetAttribute("macrotext", "/cleartarget\n/targetexact " ..name.. "\n/run SetRaidTarget(\"target\",8)")

There is some people complaining about the new warning message poping up every single time they fire the macro. In my case I just saw the message once, and after clicking "yes" it didn't show up again.

Does anybody know how to procede with this?

[Hiketeia]

Are the people getting the warning multiple times saying it is ok, or are they saying it isn't and then trying again?

[elcius]

just put the SetRaidTarget in a hook on the button when you create it

button:HookScript("OnClick", function() SetRaidTarget("target",8) end)

then omit it from the macrotext

self:SetAttribute("macrotext", "/cleartarget\n/targetexact " ..name)

[SDPhantom]

You can use the /tm command to set raid markers.

self:SetAttribute("macrotext", "/cleartarget\n/targetexact "..name.."\n/tm 8")

[TimothyLuke]

Originally Posted by maqjav Hello. In my addon I'm using the next script to target and mark a NPC. self:SetAttribute("macrotext", "/cleartarget\n/targetexact " ..name.. "\n/run SetRaidTarget(\"target\",8)") There is some people complaining about the new warning message poping up every single time they fire the macro. In my case I just saw the message once, and after clicking "yes" it didn't show up again. Does anybody know how to procede with this?

Whats causing it is the /run line. The warning was added late in Beta because some people found a chatbox exploit that if they could convince the player to enter the correct combination of characters they could set up remote connection to the client. Most hid this via a /run command and used Social Engineering things like "Our guild uses special x y z this is how to set it up."

Some people its a one off hit and forget. Other players are reporting it coming up every time they hit the macro. I dont know exactly what the rules are for the dialog yet.

Does it still trigger if you make the line a /script line? eg: /script SetRaidTarget(\"target\", 8);

[SDPhantom]

Originally Posted by TimothyLuke Does it still trigger if you make the line a /script line? eg: /script SetRaidTarget(\"target\", 8);

/script and /run are aliases of the same command. As I mentioned previously, you can get around this entire thing by using the /targetmarker (alias /tm) command.

[Ketho]

It's at least possible to hide the message, this could maybe be expanded to afterwards run some function, but makes stuff complicated

hooksecurefunc("StaticPopup_Show", function(which)
    if which == "DANGEROUS_SCRIPTS_WARNING" then
        StaticPopup_Hide(which)
        -- get and run a function from somewhere
    end
end)

Best is indeed to just use /targetmarker or convince the user to click that popup

Otherwise try something like this (proof of concept, not sure if it works from an addon)

if not AreDangerousScriptsAllowed() then
	-- create and execute that macro
end

/run print("Test Message")
/click StaticPopup1Button1
/run print("Hello World")

[Ketho]

Originally Posted by Hiketeia Are the people getting the warning multiple times saying it is ok, or are they saying it isn't and then trying again?

It should just show 1 time until you clicked yes, but Lombra mentioned there was some weird stuff happening :S

http://eu.battle.net/forums/en/wow/topic/17612912289#9

[SDPhantom]

I'm working on prototype code that looks promising. To keep the explanation short, it uses an experimental proxy system built on top of using a dedicated shared environment for scripts.

[semlar]

Originally Posted by Ketho It should just show 1 time until you clicked yes, but Lombra mentioned there was some weird stuff happening :S

Many people are running broken addons which are tainting the popup dialog so clicking "Okay" does nothing for them.

They can get rid of this dialog by disabling all of their addons, typing something like /run print("test") into the chat and then agreeing to it.

[maqjav]

Thank you everyone.

I'm going to give it a try with /targetmarker, I didn't even know it existed.
The people complaining about it gets the message everytime they click the addon button (even clicking yes on the warning message), that's why it was such a big deal, otherwise just click it once and problem fixed. Perhaps as semlar said it's an issue caused by other broken addons.

Can I enable that warning message again in my client? after cliking yes I don't see it with any character, so I don't know how to test the results.

[semlar]

Originally Posted by maqjav Can I enable that warning message again in my client? after cliking yes I don't see it with any character, so I don't know how to test the results.

To re-enable the script warning, exit the game and open WTF\Account\<account name>\config-cache.wtf

Remove the SET AllowDangerousScripts "1" line and save the file.

[Lombra]

Well I have come to terms with said weirdness, but I'm pretty sure it was much worse when I first tried it in beta.

I have this one macro, which is bound directly to a key using an addon setting an override binding. (relevance of the latter unknown) I press this key, macro is not executed and I get the popup. I click OK and get an error stating that SetAllowDangerousScripts was tainted by a different addon. Without doing anything else, I press the same key again to execute the macro, again macro is not executed and popup.. pops up. I click OK again, but no error this time. Again I don't do anything else and press the macro key a third time. This time the macro is executed without any errors or warnings.

Not sure how that works!