FEATURE: getEnvironmentVariable() & exportData() macro func

[JamzTheMan]

So I have two new functions in my Nerps build that I'd like to add:

getEnvironmentVariable(String name)
This macro function simply returns the value of an Environment Variable that matches the name passed to it.

exportData(String filePathName, String data, boolean append)
This macro function writes passed in "data" to a file @ path passed in by filePathName. If append is "true" it appends to the file otherwise it overwrites the file.


Any security concerns for either? My thought was to (if needed) write a new class to "whitelist" these advanced macros. Each time the macro is called, it will make a "security" check. It would display something like:

"Macro xyz is attempting to call function exportData. This function is attempting to write data to 'some file'. Do you wish to allow? Yes/No"

And then add a couple of checkboxes "Never ask again?" and/or "Never ask again for this Campaign?"

So the question would be, at what level would you want to "never ask again"?

1. For this MT Install, affects all campaign loads in the future
2. For this Campaign File
3. For this specific Macro
4. For this instance (would ask again if you shut down and restart MT)
5. Some combination of the above?

And/Or would you prefer a scan "on load" of a campaign and list every macro that had such functions?

Another alternative: Would you rather just limit (via Preference selection) a location(s) where exportData could write data? I personally use it to export out XP values of tokens at the end of a game to my googleDrive location (which I get via environment variable). Others may have other uses/opinions so discuss!

Edit: I'm starting to lean towards the last option, to only allow the exportData function if MT Preference "Export Data Directory" is specified and ONLY allow data to be written to that location. So only "FileName" is passed and this prevents a bad macro from writing to bad/sensitive locations and is "turned off" by default.

[RPTroll]

My 2 cents.

I like 5. I also like being asked at some level since folks share campaign files. Also, players need to know if a macro is writing things to their hard drive.

Specifying a location may be trick unless its based on MapTool's relative path, given the number of OSs supported.

I would also like to be able to read from that same location.

[JamzTheMan]

My (new) thought was, under preferences, there would be a button that launches a normal File dialog that a user can select a directory (default to .maptool dir?). That path is the stored/saved/showed in preferences for that install. The function can them only write (read) data to this one directory (and or maybe create sub dirs from this point?).

Unless this is selected the macro throws an error.

I can dump the getEnvironmentalVariable at this point as I wont need it unless someone sees a need?

[aliasmask]

So, what constitutes an environment variable? Do you mean like path= or java= type variables of the OS?

[RPTroll]

So, the question becomes what about the clients that are connected. Do they dump to the same directory on the server?

[JamzTheMan]

So, what constitutes an environment variable? Do you mean like path= or java= type variables of the OS?

Correct. Usually nothing in there to important but I was using it to set a dir path for each pc/imstance of mt.

[JamzTheMan]

So, the question becomes what about the clients that are connected. Do they dump to the same directory on the server?

It would always write locally. So if the macro was told to run on a client it would write to the client if set up.

[RPTroll]

So everyone sets this up their location and allows access on a client by client basis? Will it come with some sort of isLocalAccessAllowed() function as well to check for write permissions in macros?

Seems that if it defaults to .maptool as a default it should work ok. You'd just want to explicitly check they will allow it and make sure they get a message (at least the first time) that MapTool is about to write something out so the security conscious folks can disallow if needed.

[JamzTheMan]

So everyone sets this up their location and allows access on a client by client basis? Will it come with some sort of isLocalAccessAllowed() function as well to check for write permissions in macros?

Seems that if it defaults to .maptool as a default it should work ok. You'd just want to explicitly check they will allow it and make sure they get a message (at least the first time) that MapTool is about to write something out so the security conscious folks can disallow if needed.

Do we need the security check function? I can set it so that it returns a 1 if write is successful, 0 if write fails, and-1 if no access.

And are you saying you still want a popup warning as well even after setting the preferences to allow? Not so much an issue, just confirming.