Extensions: Removing a repo can delete user data #119481

New Issue

Harley Acheson · 2024-03-14T18:10:53+01:00

Harley Acheson commented

2024-03-14 18:10:53 +01:00

System Information
Operating system: Windows 11
Graphics card: NVIDIA GeForce RTX 4080

Blender Version
Broken: main

Short description of error
Removing a local repository can remove unrelated user files

Exact steps for others to reproduce the error

Add New Local Repository

On the resulting dialog...

The above "Custom Directory" browsing lets you select any existing folder on your system. With that knowledge, and other cues on this dialog, it would be a fair assumption that clicking "OK" will either add some files to the specified "d:\test" folder or create a new folder in it, probably called "My Repository".

Clicking OK results in a errors to the console and the following message on the page:

Note that in the above message the "folder with file" is the name of a folder that I placed in that D:\test directory for testing purposes. Although this is the only item mentioned here, there were other test items in the same folder.

Afterward though my new repository is in the list. And I can select to remove it:

It DOES give you a warning:

Although it isn't really just going to "Remove Extension Repository" as the title suggests, so this requires reading of the message content. The button text of "Remove Repository and Files" implies that this will only remove files related to the repository.

But of course it removes all files in all folders and subfolders in D:\test. As in this could contain all of a users documents and valuable files.

I'm not seeing anything in the above steps that makes it obvious that all files in the folder it has you select are in danger of deletion. And these are DELETED, not recycled.

And since we allow download of installation zip files, not just installers, we can have users who do not have to accept EULA terms before installation. So this could leave us a bit vulnerable.

**System Information** Operating system: Windows 11 Graphics card: NVIDIA GeForce RTX 4080 **Blender Version** Broken: main **Short description of error** Removing a local repository can remove unrelated user files **Exact steps for others to reproduce the error** Add New Local Repository ![image](/attachments/f035899b-5042-4fb2-986d-265db6b1cbd0) On the resulting dialog... ![image](/attachments/e2d453fe-3ed9-4e1a-beed-24d541d3d926) The above "Custom Directory" browsing lets you select any **existing** folder on your system. With that knowledge, and other cues on this dialog, it would be a fair assumption that clicking "OK" will either add some files to the specified "d:\test\" folder or create a new folder in it, probably called "My Repository". Clicking OK results in a errors to the console and the following message on the page: ![image](/attachments/0a248c47-72f8-4fc7-ad1a-54f608bc37c5) Note that in the above message the "folder with file" is the name of a folder that I placed in that D:\test directory for testing purposes. Although this is the only item mentioned here, there were other test items in the same folder. Afterward though my new repository is in the list. And I can select to remove it: ![image](/attachments/6048867a-9017-47e2-9263-85fa8d80c4e3) It DOES give you a warning: ![image](/attachments/09d6f63a-6916-4351-933d-c8524796c9ef) Although it isn't really just going to "Remove Extension Repository" as the title suggests, so this requires reading of the message content. The button text of "Remove Repository and Files" implies that this will only remove files related to the repository. But of course it removes **all files in all folders and subfolders** in D:\test. As in this could contain all of a users documents and valuable files. I'm not seeing anything in the above steps that makes it obvious that all files in the folder it has you select are in danger of deletion. And these are DELETED, not recycled. And since we allow download of installation zip files, not just installers, we can have users who do not have to accept EULA terms before installation. So this could leave us a bit vulnerable.

image.png

26 KiB

image.png

28 KiB

image.png

25 KiB

image.png

17 KiB

image.png

20 KiB

Harley Acheson added the

Type