From 16402fb6702f296d400bddb81561710d6cb37b6f Mon Sep 17 00:00:00 2001
From: s-ol <s-ol@users.noreply.github.com>
Date: Tue, 29 Oct 2019 14:33:18 +0100
Subject: fix the glaring security vulnerability i just implemented

---
 build/server.moon           |  5 +++++
 mmm/mmmfs/plugins/init.moon | 27 +++++++++++++++------------
 2 files changed, 20 insertions(+), 12 deletions(-)

diff --git a/build/server.moon b/build/server.moon
index d101d0b..b219c58 100644
--- a/build/server.moon
+++ b/build/server.moon
@@ -21,6 +21,8 @@ lfs = require 'lfs'
 server = require 'http.server'
 headers = require 'http.headers'
 
+export UNSAFE
+
 class Server
   new: (@store, opts={}) =>
     opts = {k,v for k,v in pairs opts}
@@ -29,6 +31,9 @@ class Server
     opts.onstream = @\stream
     opts.onerror = @\error
 
+    if opts.host == 'localhost'
+      UNSAFE = true
+
     @editable_paths = opts.editable_paths
 
     @server = server.listen opts
diff --git a/mmm/mmmfs/plugins/init.moon b/mmm/mmmfs/plugins/init.moon
index 12fb061..583fbb4 100644
--- a/mmm/mmmfs/plugins/init.moon
+++ b/mmm/mmmfs/plugins/init.moon
@@ -129,12 +129,6 @@ converts = {
         assert 1 == parent.childElementCount, "text/html with more than one child!"
         parent.firstElementChild
   }
-  {
-    inp: 'text/lua -> (.+)',
-    out: '%1',
-    cost: 0.5
-    transform: loadwith load or loadstring
-  }
   {
     inp: 'mmm/tpl -> (.+)',
     out: '%1',
@@ -238,6 +232,14 @@ converts = {
   }
 }
 
+if MODE == 'CLIENT' or UNSAFE
+  table.insert converts, {
+    inp: 'text/lua -> (.+)',
+    out: '%1',
+    cost: 0.5
+    transform: loadwith load or loadstring
+  }
+
 add_converts = (module) ->
   ok, plugin = pcall require, ".plugins.#{module}"
 
@@ -265,12 +267,13 @@ if MODE == 'SERVER'
   ok, moon = pcall require, 'moonscript.base'
   if ok
     _load = moon.load or moon.loadstring
-    table.insert converts, {
-      inp: 'text/moonscript -> (.+)',
-      out: '%1',
-      cost: 1
-      transform: loadwith moon.load or moon.loadstring
-    }
+    if UNSAFE
+      table.insert converts, {
+        inp: 'text/moonscript -> (.+)',
+        out: '%1',
+        cost: 1
+        transform: loadwith moon.load or moon.loadstring
+      }
 
     table.insert converts, {
       inp: 'text/moonscript -> (.+)',
-- 
cgit v1.2.3