Add script identification, require permission to r/w external files

include/config.h

@@ -150,6 +150,7 @@ public:
     QFont applicationFont;
     QFont mapListFont;
     int imageExportColorSpaceId;
+    QMap<QString,QString> trustedScriptHashes;
 
 protected:
     virtual void parseConfigKeyValue(QString key, QString value) override;

include/core/utility.h

@@ -20,6 +20,7 @@ namespace Util {
     void show(QWidget *w);
     QColorSpace toColorSpace(int colorSpaceInt);
     QString mkpath(const QString& dirPath);
+    QString getFileHash(const QString &filepath);
 }
 
 #endif // UTILITY_H

include/scripting.h

@@ -3,7 +3,10 @@
 #define SCRIPTING_H
 
 #include <QStringList>
+#include <QStack>
+#include <QFileInfo>
 #include "scriptutility.h"
+#include "utility.h"
 
 class Block;
 class Tile;
@@ -73,17 +76,58 @@ public:
     static const QImage * getImage(const QString &filepath, bool useCache);
     static QJSValue dialogInput(QJSValue input, bool selectedOk);
     static QJSValue fileResponse(const QString &s, bool isError);
+    static bool checkFilePermissions(const QString &filepath);
 
 private:
     MainWindow *mainWindow;
     QJSEngine *engine;
-    QStringList filepaths;
-    QList<QJSValue> modules;
+
+    class Script {
+        public:
+            Script() {};
+
+            QString filepath() const { return m_filepath; }
+            QString fileName() const {
+                QFileInfo fileInfo(m_filepath);
+                return fileInfo.fileName();
+            }
+            void setFilepath(const QString &filepath) { m_filepath = filepath; }
+
+            QJSValue module() const { return m_module; }
+            void setModule(const QJSValue &module) { m_module = module; }
+
+            QString hash() {
+                if (m_hash.isEmpty()) {
+                    // We won't need to check whether most scripts are trusted,
+                    // so only calculate the hash when it's first requested.
+                    m_hash = Util::getFileHash(m_filepath);
+                }
+                return m_hash;
+            }
+        private:
+            QString m_filepath;
+            QJSValue m_module;
+            QString m_hash;
+    };
+    QList<QSharedPointer<Script>> scripts;
+
+    // Tracks the scripts that are currently being evaluated.
+    // This is useful for identifying which script is responsible
+    // for calling a function at any point in time.
+    // Because executing a callback/action in one script may trigger
+    // a callback/action in a different script we may need to keep
+    // track of multiple scripts executing at once.
+    QStack<QSharedPointer<Script>> scriptExecutionStack;
+
     QMap<QString, const QImage*> imageCache;
     ScriptUtility *scriptUtility;
 
-    void loadModules(const QStringList &moduleFiles);
-    void invokeCallback(CallbackType type, QJSValueList args);
+    void loadScript(const QString &filepath);
+    void invokeCallback(CallbackType type, const QJSValueList &args);
+    void invokeCallback(QSharedPointer<const Script> script, CallbackType type, const QJSValueList &args);
+    bool invokeAction(QSharedPointer<const Script> script, const QString &functionName);
+    QSharedPointer<Script> getActiveScript() const;
+    bool askForTrust(QSharedPointer<Script> script, const QString &reason);
 };
 
 #else

include/ui/message.h

@@ -18,6 +18,7 @@
 class Message : public QMessageBox {
 public:
     Message(QMessageBox::Icon icon, const QString &text, QMessageBox::StandardButtons buttons, QWidget *parent);
+    void addStandardButtons(QMessageBox::StandardButtons buttons) { setStandardButtons(standardButtons() | buttons); }
 };
 
 // Basic error message with an 'Ok' button.