Store configuration files in a subdirectory

kanryu / quickviewer

A image/comic viewer application for Windows, Mac and Linux, it can show images very fast

https://kanryu.github.io/quickviewer/

GNU General Public License v3.0

535 stars 63 forks source link

Store configuration files in a subdirectory #175

Open zoidbergthepopularone opened 2 years ago

zoidbergthepopularone commented 2 years ago

The is preferred due to the better security properties - the directory may be made writable without allowing modifications to the binary files. However, since this breaks compatibility with current installations, it is only used if the directory exists. Otherwise the original behavior (config files directly next to the main binary files) is used.

zoidbergthepopularone commented 2 years ago

Refers to https://github.com/kanryu/quickviewer/issues/71. It's not been tested because I can't compile the sources!

kanryu commented 2 years ago

I think there are two problems with this pull request.

The process of creating a'config'directory is not implemented.
Unlike when you first posted the #71 issue, QuickViewer now saves files under AppDir when installed under'Program Files'. This behavior should solve the security problem you are looking for.

zoidbergthepopularone commented 2 years ago

The process of creating the config directory is not implemented on purpose. I don't want to break the application for people who already have QuickViewer installed. That's why the directory is only used if it already exists. Implementing directory creation and file movement is more than I feel comfortable doing blind.

Saving files under AppDir does not solve the problem of configuration files stored in the directory with executables in the portable version. There it also makes sense to separate the configs (writable) and the binaries (read-only).

kanryu commented 2 years ago

As a general rule, applications should not implement behavior that is not intended by the user. In this case, the behavior will change with and without the'config'directory.
When an application is installed under'Program Files', it is common behavior on Windows today that configuration files are saved under'AppDir' for individual users. It is unlikely that this specification remains a security issue.