Re: Policy for opening url links in documents

2023-08-29 Thread Pavel Sanda
On Thu, Aug 17, 2023 at 08:54:43AM +0200, Jürgen Spitzmüller wrote: > So a dialog that says: > > > LyX wants to open the following link in an external application: > > Be aware that this might entail security infringements. Only do this if > you trust origin of the document and the target of

Re: Policy for opening url links in documents

2023-08-17 Thread Jürgen Spitzmüller
Am Donnerstag, dem 17.08.2023 um 18:34 +0200 schrieb Pavel Sanda: > My point was that I would add "trust of the source of the document" > in the equation as well (in whatever wording). > Eye-inspection of URL can be easily befooled if the document comes > from an attacker. I agree that this shoul

Re: Policy for opening url links in documents

2023-08-17 Thread Pavel Sanda
On Thu, Aug 17, 2023 at 05:32:37PM +0200, Jürgen Spitzmüller wrote: > Am Donnerstag, dem 17.08.2023 um 17:27 +0200 schrieb Jürgen > Spitzmüller: > > I think it is useful to see the URL/target and then decide. If I get > > a document from someone else and the proposed link looks suspicious, > > I'd

Re: Policy for opening url links in documents

2023-08-17 Thread Pavel Sanda
On Thu, Aug 17, 2023 at 11:09:54AM -0400, Richard Kimberly Heck wrote: > The normal case, I assume, is: The document is mine, and so is the bib file. Right, otherwise you are on the wild side. We should perhaps write something along these lines to User Guide as well. Pavel -- lyx-devel mailing

Re: Policy for opening url links in documents

2023-08-17 Thread Jürgen Spitzmüller
Am Donnerstag, dem 17.08.2023 um 17:27 +0200 schrieb Jürgen Spitzmüller: > I think it is useful to see the URL/target and then decide. If I get > a document from someone else and the proposed link looks suspicious, > I'd rather not open it. Other links might look trustworthy and I can > proceed for

Re: Policy for opening url links in documents

2023-08-17 Thread Jürgen Spitzmüller
Am Donnerstag, dem 17.08.2023 um 16:47 +0200 schrieb Pavel Sanda: > On the other hand to me the primary question is whether you trust the > source of the > document (basically someone else than you?), so the proposed warning > dialog > should imho ask whether you trust origin of the document and co

Re: Policy for opening url links in documents

2023-08-17 Thread Richard Kimberly Heck
On 8/17/23 10:47, Pavel Sanda wrote: On Thu, Aug 17, 2023 at 08:54:43AM +0200, Jürgen Spitzmüller wrote: BTW are we talking URLs only or also links to local files? I am actually not sure what magic can be done with the scheme prefixes, like what happen on mac if you specify something else than

Re: Policy for opening url links in documents

2023-08-17 Thread Pavel Sanda
On Wed, Aug 16, 2023 at 09:50:18PM -0400, Richard Kimberly Heck wrote: > >BTW, there is a RC already (but not evaluated in this code path) - > >citation_search. Perhaps it can be used here? > > That seems to be for something else---whether to use a script to search for > a PDF or whatever---but i

Re: Policy for opening url links in documents

2023-08-17 Thread Pavel Sanda
On Wed, Aug 16, 2023 at 07:00:18PM -0400, Richard Kimberly Heck wrote: > On 8/16/23 18:29, Pavel Sanda wrote: > >On Wed, Aug 16, 2023 at 05:30:56PM -0400, Richard Kimberly Heck wrote: > >>>Now what are your opinions what we should do about it? > >>>1) nothing. > >>>2) add dialog before launching ur

Re: Policy for opening url links in documents

2023-08-17 Thread Pavel Sanda
On Thu, Aug 17, 2023 at 08:54:43AM +0200, Jürgen Spitzmüller wrote: > I am not sure we really need a pref to bypass this measure, or disable > the feature completely (as in needauth). This strikes me > overregulation. I don't have clerar opinion here. > BTW are we talking URLs only or also links

Re: Policy for opening url links in documents

2023-08-16 Thread Jürgen Spitzmüller
Am Mittwoch, dem 16.08.2023 um 14:33 -0400 schrieb Scott Kostyshak: > I think Daniel is talking about: > >   Document > Settings > Format > Output > "Allow running external > programs" Or, for that matter, Tools > Preferences > File Handling > Converters > Use needauth option > > Whether 5 or 6

Re: Policy for opening url links in documents

2023-08-16 Thread Richard Kimberly Heck
On 8/16/23 19:26, Stephan Witt wrote: Am 17.08.2023 um 01:00 schrieb Richard Kimberly Heck : On 8/16/23 18:29, Pavel Sanda wrote: On Wed, Aug 16, 2023 at 05:30:56PM -0400, Richard Kimberly Heck wrote: Now what are your opinions what we should do about it? 1) nothing. 2) add dialog before launc

Re: Policy for opening url links in documents

2023-08-16 Thread Stephan Witt
Am 17.08.2023 um 01:00 schrieb Richard Kimberly Heck : > > On 8/16/23 18:29, Pavel Sanda wrote: >> On Wed, Aug 16, 2023 at 05:30:56PM -0400, Richard Kimberly Heck wrote: Now what are your opinions what we should do about it? 1) nothing. 2) add dialog before launching url. safer but

Re: Policy for opening url links in documents

2023-08-16 Thread Richard Kimberly Heck
On 8/16/23 18:29, Pavel Sanda wrote: On Wed, Aug 16, 2023 at 05:30:56PM -0400, Richard Kimberly Heck wrote: Now what are your opinions what we should do about it? 1) nothing. 2) add dialog before launching url. safer but super annoying. 3) add dialog before launching url + dont ask again checkbo

Re: Policy for opening url links in documents

2023-08-16 Thread Pavel Sanda
On Wed, Aug 16, 2023 at 05:30:56PM -0400, Richard Kimberly Heck wrote: > >Now what are your opinions what we should do about it? > >1) nothing. > >2) add dialog before launching url. safer but super annoying. > >3) add dialog before launching url + dont ask again checkbox. > >not implemented -

Re: Policy for opening url links in documents

2023-08-16 Thread Richard Kimberly Heck
On 8/16/23 10:35, Pavel Sanda wrote: Hi, as a part of #12878 Stephan raised a question to what degree should we allow opening external links which are part of citation in the document (or rather part of .bib file). Currently we allow opening links stored in the "url" field of bibtex entry or fi

Re: Policy for opening url links in documents

2023-08-16 Thread Daniel
On 2023-08-16 20:33, Scott Kostyshak wrote: On Wed, Aug 16, 2023 at 06:30:38PM +0200, Daniel wrote: On 2023-08-16 16:35, Pavel Sanda wrote: Hi, as a part of #12878 Stephan raised a question to what degree should we allow opening external links which are part of citation in the document (or ra

Re: Policy for opening url links in documents

2023-08-16 Thread Scott Kostyshak
On Wed, Aug 16, 2023 at 06:30:38PM +0200, Daniel wrote: > > On 2023-08-16 16:35, Pavel Sanda wrote: > > Hi, > > > > as a part of #12878 Stephan raised a question to what degree should we allow > > opening external links which are part of citation in the document (or rather > > part of .bib file).

Re: Policy for opening url links in documents

2023-08-16 Thread Daniel
On 2023-08-16 16:35, Pavel Sanda wrote: Hi, as a part of #12878 Stephan raised a question to what degree should we allow opening external links which are part of citation in the document (or rather part of .bib file). Currently we allow opening links stored in the "url" field of bibtex entry or

Policy for opening url links in documents

2023-08-16 Thread Pavel Sanda
Hi, as a part of #12878 Stephan raised a question to what degree should we allow opening external links which are part of citation in the document (or rather part of .bib file). Currently we allow opening links stored in the "url" field of bibtex entry or files stored in "file" field by entry in