>  > However,
>  >
>  > 1. They can be there, maybe in gray color, to tell users where the
>  > files are embedded.
>
>   To be useful under your conditions this file needs to be changed. You can
>  decide to use another source or during a reorganization its location may
>  change.

In the current design, this file can be changed through 'update from
external file'. Anyway, the point is that I want to know that this
figure is originally '../images/blah.png'.

>  > 2. During unbundling, the external version will be compared with the
>  > embedded version. If the external version exist, and is identical to
>  > the embedded file, there is no need to unbundle this file to the
>  > document directory. That is to say, you *do not have to* extract these
>  > files to the document directory to successfully unbundle a file.
>
>   If it was not clear I think that by security considerations we should not
>  extract the files to the current directory but to a new/fresh directory. This
>  means that the files are in a new namespace that will be translated to a new
>  directory.

The current implementation put  /abs/file as LyX.Embed.Abs/abs/file,
../file as LyX.Embed.Rel/file under the temp directory. We can
certainly use something similar under the document directory.


>  > Yes. This is my dirty trick (you will dislike this word) to keep my
>  > out of tree files. Because these files are rarely modified, I expect
>  > to unbundle my .lyx files successfully under my computer(s) without
>  > having to copy them to my document directory. On other systems, the
>  > 'update from external file' menu item will be disable if a matching
>  > file is not found.
>
>   At this level I dislike dirty tricks. We have been considering for years the
>  expansion of the external insets and we have never done precisely because of
>  these kinds of problems. Security is an important issue. The original file
>  path of embedded files should not be saved in the lyx file.

See below.

>   If you, a power user, want to keep an accounting of the embedded files and
>  its original source that is acceptable but this feature should not be in
>  standard lyx even if optional.
>
>  >
>
>   If the file path is not necessary it should not be there. Less is more.
>  Again this information is only relevant in one machine just like the cursor
>  position. For me they are the same type of information, where as been your
>  last cursor position in a file and what was your original file path, even if
>  that path is relative. They should not be leaked if a file is transferred.

As I have said, this information is relevant on more than one machines.

  > But of course another computer 'can' have these files. In my case, I
  > have my complete svn tree on a few different machines. linux or
  > windows.

Also, as I have suggested, if security was a concern in this case, why
lyx allow the use of out of tree files? The absolute or relative paths
are there, in the .lyx file, and in the GUI. If this was a problem,
embedding does not make it worse.

Bo

Reply via email to