jiri/org-ql
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix: (org-ql-view--expand-buffers-files) Remove eval support

Browse source 
This prevents arbitrary code execution when opening "org-ql-search:"
links.  (The links feature was just pushed to master in the last day
or so, and no stable release with the feature has been tagged.)  This
fix also means that arbitrary expressions are no longer accepted when
interactively completing the buffers-files argument to
org-ql-search (a worthy trade, I think; users who need to do that can
call the function from Lisp).
This commit is contained in:
Adam Porter 2020-11-11 20:45:10 -06:00
parent c2c7efed00
commit 6ab74454d0
4 changed files with 37 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

1
README.org
View file

@ -106,7 +106,6 @@ Read ~QUERY~ and search with ~org-ql~. Interactively, prompt for these variable
+ ~buffer~: search the current buffer
+ ~all~: search all Org buffers
+ ~agenda~: search buffers returned by the function ~org-agenda-files~
+ An expression which evaluates to a list of files/buffers
+ A space-separated list of file or buffer names
~GROUPS~: An ~org-super-agenda~ group set. See variable ~org-super-agenda-groups~.