Plugin security

I'm wondering if the current checks on the plugin security are not enough or silly and in the won't-ever-prevent-much category?

Right now we check to see if the requested plug has been "authorized" and let the user decide if he/she wants to use it.

One of the things we do is to run a checksum on the main module. This is stored with the authorization. If the checksum changes, we request a new authorization.

But, it's really silly since it's very easy for a "bad person" to sidestep with by calling another module. Leave the main "plugin.py" alone and modify something it calls. And so we go down the rabbit hole.

My proposal is to dump the checksum and just ask if the directory/module is okay.

And what do you folks think. Please let me know.

New version 12.15.a

At some point we have to release our children into the wild world. Here's the latest! A new test version of mma is now available. Lots of new stuff for you guys to break!

    BUGFIX: lots of minor things.
    ENHANCEMENT: Multiple +/- for chord octaves.
    BUGFIX: string compares were wrong.
    BUGFIX: timing issue with plectrum tracks.
    ENHANCEMENT: error/warning messages pretty print.
    NEW: Plugins! RTFM!!!!
    ENHANCEMENT: added chords 7b5(add13) and 7(add13).
    ENHANCEMENT: ChordAdjust adds RESET and concated names. Also new macro $_ChordAdjust.
    CHANGE: Version numbering now inserts a . before minor.
    CHANGE: the HTML docs now include the chord and plugin references.

I think the biggest thing is the plugin support. Please have fun and see how useful this can be. Let me know!

Get it at: http://mellowood.ca/mma/downloads.html#developer

Comments

I had a comment the other day from a user who said he couldn't post a comment. Seems to work for me. Here's what I did, after signing in to Google as a different user, but I'm not sure that is needed ....

1. Click on the text <xx comments> or <no comments> at the bottom of every post.

2. Enter you comment.

3. It's that simple.

4. I have to approve each comment. I get a notice in my mail that you have commented, and I get to decide if I want it published. And, unless it's obvious spam/scam I'll approve.

5. Moments later ... the comment should appear.

So, please post your comments! And if you have a problem, sent me an email.

Thanks.

ChordAdjust

I did a bit of work on ChordAdjust today. Added a <reset> option and you can now concat a bunch of chord names (F,G,F#=-1) instead of doing them one by one.

I've done more work on the plugin module as well and now have better feeling about the security of the thing. Users now need to enable each plugin. Of course, the settings are saved so it only needs to be once.

Stay tuned.

STICKY bug fixed

So, I was going to work on more docs today ... well, after I did a track for a little song I transcribed from a fake book. And, knowing everything about MMA, I decided to use the Sticky track feature. Only problem was that it just didn't work.

To make the story about a long debugging session short, the SeqClear command was wiping out the settings so carefully set in my track. The fix was simple: just don't clear sticky tracks!

Done.

We are getting real close to a new developer release. I just finished off the first draft of the plugin API document. Gotta let it simmer for a few days, re-read and edit.

A few more little things and I'll do the release!

I've made a minor change to way the html docs are packages. I now have an entry for the yet-to-be-written plugin reference guide and one for the chord reference manual (list of all chords MMA knows about). This is all on the documentation page, so should make it easy to access it all.