Hardened Sandbox Permission For Zotero 7 Beta

czhang03 commented 4 months ago

Hardens sandbox permissions, implementing https://github.com/flathub/org.zotero.Zotero/issues/154:

remove all file access permission to use portal by default.
use persistent folder to sandbox zotero folders.

Potiential problems:

Breaks drag and drop, which needs DE to provide support for it:
- gnome: https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/418
- qt (I assume impacts KDE): https://bugreports.qt.io/browse/QTBUG-91357
- sway: https://github.com/swaywm/sway/issues/6460
The zotero folder is now in sandbox, I don't know if people will be confused by this.
(minor) Enable home access will cause zotero to use folders (Zotero and .zotero) in home instead of in the sandbox.

An alternative way to go is to enable --filesystem=home by default, with a guide to disable it in the app description. This alternative is implemented by #156.

flathubbot commented 4 months ago

Started test build 110306

flathubbot commented 4 months ago

Build 110306 successful To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/93131/org.zotero.Zotero.flatpakref

czhang03 commented 4 months ago

closing in favor of #156

flathub / org.zotero.Zotero

Hardened Sandbox Permission For Zotero 7 Beta #155