You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This ticket is created to combine all related issues.
Rationale
KWin allows scripts to provide a custom configuration dialog, which can be accessed through "KWin Scripts" panel in System Settings. However, KWin only accepts Qt Designer UI file for this purpose, which is mostly static and doesn't allow any programming logic inside. This imposes a significant limitation on how scripts can be configured.
Here, accepting external config files opens up many possibilities, including the ones already employed by independent applications. For example:
Krohnkite is a "declarative script", that is based on QML, and QML provides XMLHttpRequest function, which can be used to access local files. Combining this with JSON interface built into the Javascript engine, it should be possible to read an external JSON file as a config file with a minimum effort.
Possible Security Concern
While this feature itself won't cause any security problems, the fact that KWin extension scripts can read local files is a security problem. QML-based scripts also can access network using various modules, and this means scripts can both read local data and transmit it over the network. This is enough to create a malware capable of stealing user credentials and probing system configuration.
The text was updated successfully, but these errors were encountered:
I like this idea. My main reason for using Krohnkite is a lack of a decent compositor for i3 and using the kwin script settings to configure tiling is a concession I made (I very much liked the config file approach i3 uses) in order to get proper vsync without screen tearing.
This ticket is created to combine all related issues.
Rationale
KWin allows scripts to provide a custom configuration dialog, which can be accessed through "KWin Scripts" panel in System Settings. However, KWin only accepts Qt Designer UI file for this purpose, which is mostly static and doesn't allow any programming logic inside. This imposes a significant limitation on how scripts can be configured.
Here, accepting external config files opens up many possibilities, including the ones already employed by independent applications. For example:
Technical Aspect
Krohnkite is a "declarative script", that is based on QML, and QML provides XMLHttpRequest function, which can be used to access local files. Combining this with
JSON
interface built into the Javascript engine, it should be possible to read an external JSON file as a config file with a minimum effort.Possible Security Concern
While this feature itself won't cause any security problems, the fact that KWin extension scripts can read local files is a security problem. QML-based scripts also can access network using various modules, and this means scripts can both read local data and transmit it over the network. This is enough to create a malware capable of stealing user credentials and probing system configuration.
The text was updated successfully, but these errors were encountered: