Fixing mod security related bug

Readme.md

@@ -43,6 +43,8 @@ You need the `voxelizer` priv to use any of the Voxelizer commands. Some command
 Media - models, textures and nodemaps (color lookups) - is stored in `<worldpath>/media`.
 If you are unsure about which settings to use, either do some research or *try it and see*.
 Editing the placed models is recommended; Voxelizer might place a few blocks undesirably, which needs to be fixed by hand.
+Voxelizer needs to be added as to the trusted mods in the settings in order to be able to read textures or download files.
+Disabling mod security would also work but is **not** recommended.
 
 ### Configuration
 

chatcommands.lua

@@ -1,3 +1,7 @@
+local os_execute
+function set_os_execute(os_exec)
+    os_execute = os_exec
+end
 local conf = config
 local defaults = conf.defaults
 
@@ -328,8 +332,7 @@ if conf.download then
 
             local path = voxelizer.get_media(params.filename)
             local call = string.format('java -classpath "%s/production" FileDownloader "%s" "%s"', minetest.get_modpath("voxelizer"), params.url, path)
-            print(call)
-            local response_code = os.execute(call)
+            local response_code = os_execute(call)
             if response_code ~= 0 then
                 local error = errors[response_code]
                 if error then return false, "Download failed : "..error end

init.lua

@@ -1,6 +1,6 @@
 voxelizer={}
 minetest.mkdir(minetest.get_worldpath().."/media") -- Create media dir
---cmd_ext.register_chatcommand()
+local os_execute = (minetest.request_insecure_environment() or error("Please add voxelizer to the trusted mods in settings, or disable it. See the Readme for details.")).os.execute
 extend_mod("voxelizer", "conf") -- Load JSON configuration stored in worldpath
 extend_mod("voxelizer", "vector") -- Own vector lib, operating on lists
 extend_mod("voxelizer", "closest_color") -- Closest color finder, uses linear search / k-d tree depending on number of colors
@@ -9,7 +9,9 @@ extend_mod("voxelizer", "dithering") -- Error diffusion dithering
 extend_mod("voxelizer", "obj_reader") -- OBJ reader, reads simple OBJ models
 extend_mod("voxelizer", "node_map_reader") -- Node map reader, reads minetestmapper-colors.txt like files
 extend_mod("voxelizer", "main") -- Main : Actual API for placing of models using VoxelManip
+voxelizer.set_os_execute(os_execute) -- Passing insecure os.execute while keeping it local
 extend_mod("voxelizer", "chatcommands") -- Chatcommands for making use of the API
+voxelizer.set_os_execute(os_execute) -- Passing insecure os.execute while keeping it local
 
 -- Tests : Only uncomment if you actually want to test something !
 --[[minetest.register_on_mods_loaded(function()

texture_reader.lua

@@ -1,3 +1,8 @@
+local os_execute
+function set_os_execute(os_exec)
+    os_execute = os_exec
+end
+
 function rgba_number_to_table(number)
     local b = number % 256
     local g = math.floor(number / 256) % 256
@@ -105,7 +110,7 @@ function read_texture(path_to_texture)
         else
             path_to_output = path_to_texture:sub(1, last_dot-1)..".sif"
         end
-        local response_code = os.execute('java -classpath "'..minetest.get_modpath("voxelizer")..'/production" TextureLoader "'..path_to_texture..'" "'..path_to_output..'"')
+        local response_code = os_execute('java -classpath "'..minetest.get_modpath("voxelizer")..'/production" TextureLoader "'..path_to_texture..'" "'..path_to_output..'"')
         if response_code ~= 0 then
             return errors[response_code] or "Texture couldn't be converted"
         end