search

hugolabe / Wike

Wikipedia Reader for the GNOME Desktop
https://hugolabe.github.io/Wike/
GNU General Public License v3.0
231 stars 32 forks source link

close unnecessary $HOME hole in sandbox #129

Closed camelCaseNick closed 1 year ago

camelCaseNick commented 1 year ago

Wike does not need access to $HOME as it merely opens files $XDG_DATA_HOME that inside the flatpak sandbox is assured to be set to an accessible path.

Or am I mistaken? I did check the source code and am using Wike now with this hole closed and tried to test everything I know of you could do with it, but maybe I just didn't find the part, where this hole is needed.

hugolabe commented 1 year ago

This cannot be removed. It is necessary for the export to PDF and if you remove it the print dialog does not open, since it gives an error when looking for the download folder.

I considered the option of limiting the access to only xdg-download but this also causes problems, since when selecting another folder to save the article (eg. Documents) the path shown in the dialog is not correct, which is quite confused.

Screenshot-2023-04-27-09-38-58

pedropaulosuzuki commented 1 month ago

This cannot be removed. It is necessary for the export to PDF and if you remove it the print dialog does not open, since it gives an error when looking for the download folder.

I considered the option of limiting the access to only xdg-download but this also causes problems, since when selecting another folder to save the article (eg. Documents) the path shown in the dialog is not correct, which is quite confused.

Screenshot-2023-04-27-09-38-58

Webkit has just changed the print workflow. In theory, we could revisit this issue and see if we can drop the sandbox hole now, or if there are other blockers.