[crossfire] Patches on tracker

[Mark Wedel]

Nicolas Weeger wrote:

>> https://sourceforge.net/tracker/index.php?func=detail&aid=1680135&group_id=
>> 13833&atid=313833 Buildable buildings
>> as that one says, full buildings you can buy & enter later
>> could be fun too (but script would also need some tweaking, hardcoded paths
>> aren't fun ^_-)
> 
> Looking at the script, it has one drawback/thing to consider: to work, it 
> requires write access to (a subdirectory of) the maps directory, as it copies 
> template maps to a subdirectory.
> Would that be a security concern? Not sure of another way to do that, though, 
> as buildings are not player unique maps (other players can use it).
> I do think I'll commit it anyway, if no one objects.

  Yes, that is a problem.

  The fact that the maps are in the 'share' directory means that write access to 
that area is not a requirement.  Lack of write access could be for any number of 
reasons - permissions issues, or for some sites, something like that could be 
put on a read-only filesystem.

  I'd also think there are some problems as related to packaging - various 
packaging programs removing the entire map area on upgrades, etc.

  IMO, for that patch to be acceptable, it must write someplace under the var/ 
install area, which is the area for read/write files.  It probably wouldn't be 
that hard to modify the respective map code such that if it doesn't find the map 
in share/maps/... to look in var/maps/...