Quantcast
New "Running scripts could compromise..." warning - WoWInterface
Thread Tools Display Modes
07-27-16, 02:04 PM   #1
maqjav
A Cyclonian
Join Date: Feb 2012
Posts: 48
New "Running scripts could compromise..." warning

Hello.

In my addon I'm using the next script to target and mark a NPC.

Code:
self:SetAttribute("macrotext", "/cleartarget\n/targetexact " ..name.. "\n/run SetRaidTarget(\"target\",8)")
There is some people complaining about the new warning message poping up every single time they fire the macro. In my case I just saw the message once, and after clicking "yes" it didn't show up again.

Does anybody know how to procede with this?
  Reply With Quote
07-27-16, 02:20 PM   #2
Hiketeia
An Aku'mai Servant
 
Hiketeia's Avatar
AddOn Author - Click to view addons
Join Date: Apr 2016
Posts: 33
Are the people getting the warning multiple times saying it is ok, or are they saying it isn't and then trying again?
  Reply With Quote
07-27-16, 03:26 PM   #3
elcius
A Cliff Giant
AddOn Author - Click to view addons
Join Date: Sep 2011
Posts: 71
just put the SetRaidTarget in a hook on the button when you create it
Code:
button:HookScript("OnClick", function() SetRaidTarget("target",8) end)
then omit it from the macrotext
Code:
self:SetAttribute("macrotext", "/cleartarget\n/targetexact " ..name)
  Reply With Quote
07-27-16, 04:16 PM   #4
SDPhantom
A Pyroguard Emberseer
 
SDPhantom's Avatar
AddOn Author - Click to view addons
Join Date: Jul 2006
Posts: 1,924
You can use the /tm command to set raid markers.
Code:
self:SetAttribute("macrotext", "/cleartarget\n/targetexact "..name.."\n/tm 8")
__________________
ESOUI AddOns | WoWInterface AddOns
"All I want is a pretty girl, a decent meal, and the right to shoot lightning at fools."
-Anders (Dragon Age: Origins - Awakening)
  Reply With Quote
07-27-16, 04:21 PM   #5
TimothyLuke
A Fallenroot Satyr
 
TimothyLuke's Avatar
AddOn Author - Click to view addons
Join Date: Jan 2010
Posts: 24
Originally Posted by maqjav View Post
Hello.

In my addon I'm using the next script to target and mark a NPC.

Code:
self:SetAttribute("macrotext", "/cleartarget\n/targetexact " ..name.. "\n/run SetRaidTarget(\"target\",8)")
There is some people complaining about the new warning message poping up every single time they fire the macro. In my case I just saw the message once, and after clicking "yes" it didn't show up again.

Does anybody know how to procede with this?

Whats causing it is the /run line. The warning was added late in Beta because some people found a chatbox exploit that if they could convince the player to enter the correct combination of characters they could set up remote connection to the client. Most hid this via a /run command and used Social Engineering things like "Our guild uses special x y z this is how to set it up."

Some people its a one off hit and forget. Other players are reporting it coming up every time they hit the macro. I dont know exactly what the rules are for the dialog yet.

Does it still trigger if you make the line a /script line? eg: /script SetRaidTarget(\"target\", 8);
__________________
BattleNet: TimothyLuke#1860
WowLazyMacros/Curse/GitHub/WowInterface: TimothyLuke

Most Commonly Played Characters:
[email protected]'Remar
[email protected]
  Reply With Quote
07-27-16, 04:59 PM   #6
SDPhantom
A Pyroguard Emberseer
 
SDPhantom's Avatar
AddOn Author - Click to view addons
Join Date: Jul 2006
Posts: 1,924
Originally Posted by TimothyLuke View Post
Does it still trigger if you make the line a /script line? eg: /script SetRaidTarget(\"target\", 8);
/script and /run are aliases of the same command. As I mentioned previously, you can get around this entire thing by using the /targetmarker (alias /tm) command.
__________________
ESOUI AddOns | WoWInterface AddOns
"All I want is a pretty girl, a decent meal, and the right to shoot lightning at fools."
-Anders (Dragon Age: Origins - Awakening)
  Reply With Quote
07-27-16, 05:03 PM   #7
Ketho
A Molten Giant
 
Ketho's Avatar
AddOn Author - Click to view addons
Join Date: Mar 2010
Posts: 928
It's at least possible to hide the message, this could maybe be expanded to afterwards run some function, but makes stuff complicated

Lua Code:
  1. hooksecurefunc("StaticPopup_Show", function(which)
  2.     if which == "DANGEROUS_SCRIPTS_WARNING" then
  3.         StaticPopup_Hide(which)
  4.         -- get and run a function from somewhere
  5.     end
  6. end)

Best is indeed to just use /targetmarker or convince the user to click that popup

Otherwise try something like this (proof of concept, not sure if it works from an addon)

Code:
if not AreDangerousScriptsAllowed() then
	-- create and execute that macro
end
Code:
/run print("Test Message")
/click StaticPopup1Button1
/run print("Hello World")


Last edited by Ketho : 07-27-16 at 05:09 PM.
  Reply With Quote
07-27-16, 05:29 PM   #8
Ketho
A Molten Giant
 
Ketho's Avatar
AddOn Author - Click to view addons
Join Date: Mar 2010
Posts: 928
Originally Posted by Hiketeia View Post
Are the people getting the warning multiple times saying it is ok, or are they saying it isn't and then trying again?

It should just show 1 time until you clicked yes, but Lombra mentioned there was some weird stuff happening :S

http://eu.battle.net/forums/en/wow/topic/17612912289#9
  Reply With Quote
07-27-16, 06:49 PM   #9
SDPhantom
A Pyroguard Emberseer
 
SDPhantom's Avatar
AddOn Author - Click to view addons
Join Date: Jul 2006
Posts: 1,924
I'm working on prototype code that looks promising. To keep the explanation short, it uses an experimental proxy system built on top of using a dedicated shared environment for scripts.
__________________
ESOUI AddOns | WoWInterface AddOns
"All I want is a pretty girl, a decent meal, and the right to shoot lightning at fools."
-Anders (Dragon Age: Origins - Awakening)
  Reply With Quote
07-28-16, 03:25 AM   #10
semlar
A Pyroguard Emberseer
 
semlar's Avatar
AddOn Author - Click to view addons
Join Date: Sep 2007
Posts: 1,059
Originally Posted by Ketho View Post
It should just show 1 time until you clicked yes, but Lombra mentioned there was some weird stuff happening :S
Many people are running broken addons which are tainting the popup dialog so clicking "Okay" does nothing for them.

They can get rid of this dialog by disabling all of their addons, typing something like /run print("test") into the chat and then agreeing to it.
  Reply With Quote
07-28-16, 06:39 AM   #11
maqjav
A Cyclonian
Join Date: Feb 2012
Posts: 48
Thank you everyone.

I'm going to give it a try with /targetmarker, I didn't even know it existed.
The people complaining about it gets the message everytime they click the addon button (even clicking yes on the warning message), that's why it was such a big deal, otherwise just click it once and problem fixed. Perhaps as semlar said it's an issue caused by other broken addons.

Can I enable that warning message again in my client? after cliking yes I don't see it with any character, so I don't know how to test the results.

Last edited by maqjav : 07-28-16 at 06:42 AM.
  Reply With Quote
07-28-16, 07:02 AM   #12
semlar
A Pyroguard Emberseer
 
semlar's Avatar
AddOn Author - Click to view addons
Join Date: Sep 2007
Posts: 1,059
Originally Posted by maqjav View Post
Can I enable that warning message again in my client? after cliking yes I don't see it with any character, so I don't know how to test the results.
To re-enable the script warning, exit the game and open WTF\Account\<account name>\config-cache.wtf

Remove the SET AllowDangerousScripts "1" line and save the file.
  Reply With Quote
07-28-16, 06:31 PM   #13
Lombra
A Molten Giant
 
Lombra's Avatar
AddOn Author - Click to view addons
Join Date: Nov 2006
Posts: 554
Well I have come to terms with said weirdness, but I'm pretty sure it was much worse when I first tried it in beta.

I have this one macro, which is bound directly to a key using an addon setting an override binding. (relevance of the latter unknown) I press this key, macro is not executed and I get the popup. I click OK and get an error stating that SetAllowDangerousScripts was tainted by a different addon. Without doing anything else, I press the same key again to execute the macro, again macro is not executed and popup.. pops up. I click OK again, but no error this time. Again I don't do anything else and press the macro key a third time. This time the macro is executed without any errors or warnings.

Not sure how that works!
__________________
Grab your sword and fight the Horde!
  Reply With Quote

WoWInterface » AddOns, Compilations, Macros » AddOn Help/Support » New "Running scripts could compromise..." warning

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off