blackbox-0.65.0-r3 includes a patch to disable the rootCommand option in style files. While I agree it's security wise questionable, it's not exactly a security hole. The command is executed as the user using blackbox, not the root uid. Only users downloading and just using styles will be affected. But those users will also argue, that the styles simply do not work, because they won't see the background pic that came with the style. Also choosing a style from bbconf will not update the background picture. It's a bit annoying to have to update the bg pic every manually and only doable for the advanced users. I think replacing the rootCommand option within blackbox style files with an backgroundPic option would be much better. This option does not get a full command, but only the path to the bg pic, which is then set by blackbox by calling xv (after checking the option string). Unfortunately this will make all current styles simply unusable. Maybe parsing the rootCommand option for the bg pic path and setting the proposed backgroundPic would do the trick. Currently this patch reduces the functionality of blackbox quite severly. Having the X gray background is not nice. Reproducible: Always Steps to Reproduce: 1. Install blackbox 2. set styleFile in .blackboxrc to a style with a background image 3. restart blackbox Actual Results: the background pic is not set, you see the X gray background Expected Results: the background pic of the chosen style should have been set
Its removal was discussed by several developers and was fully intentional. There is no (or very little) activity on Blackbox upstream, so in this case it was nessecitated that I create my own patch. This problem also affects Fluxbox, but as that project is more active, I was able to contact its developers on the issue, and they have come up w/ something similar to your first idea (reading a style attribute containing only the path to an image). If you can produce a better patch, I will gladly review and likely include it.
If anyone attempts to create a patch, please think it through carefully. The existing code simply passes the full rootCommand to bexec(). If the same method is employed, but using a predefined bg setter, make sure that no code can be appended to the bg attribute and blindly passed to the bexec(). PS, I dont mean for this to be inflamatory, but if it is difficult for a user to set his own root image, he is using the wrong distro, and probably the wrong WM. If this is a genuine issue for people, I would be glad to walk them through it, as I am constantly supporting our distro on IRC, and others on the forums.
Sorry, guys. I'm unable to provide a patch for BlackBox. Guess I'll have to live with this, until someone else is able to resolve this.
