The `/tmp/user` directory is owned by root, this solution prevents
malicious users to interfere with other users' portals.
This commit also moves `launch`'s portal in the user directory.
Various changes are needed to support this:
- The directory is created by Core::Account on login (and located in
/tmp).
- Service's sockets are now deleted on exit (to allow re-creation)
- SystemServer needs to handle SIGTERM to correctly destroy services.
Each of these strings would previously rely on StringView's char const*
constructor overload, which would call __builtin_strlen on the string.
Since we now have operator ""sv, we can replace these with much simpler
versions. This opens the door to being able to remove
StringView(char const*).
No functional changes.
This commit moves the length calculations out to be directly on the
StringView users. This is an important step towards the goal of removing
StringView(char const*), as it moves the responsibility of calculating
the size of the string to the user of the StringView (which will prevent
naive uses causing OOB access).
Converts Help's layout to GML, propagates model and icon creation
errors, and switches to the MainWidget-namespace organization
pattern seen in more up-to-date apps like TextEditor to make things
easier to maintain going forward.
Different thread highlights between widgets lead to different
visual weights between splitters, even when they have the same
width or height. This means some splitters look best at odd
sizes while others even. This sets the default spacing to the
most commonly used, depending on orientation, and adjusts
spacing for a few apps based on the new paint rect.
The most consistent look across apps requires some manual
tweaking occassionally. Knurlheads, use your discretion!
The URLs of the form `help://man/<section>/<page>` link to another help
page inside the help application. All previous relative page links are
replaced by this new form. This doesn't change any behavior but it looks
much nicer :^)
Note that man doesn't handle these new links, but the previous relative
links didn't work either.
Link handling is now split up between open_page and open_url. While
open_page can handle any sort of input and is responsible for handling
history UI, open_url deals in URLs and takes one of a few different
actions depending on the exact URL given. Currently, only file:// URLs
are handled but this will change in the next few commits.
Note that this commit breaks relative URLs on purpose. After the new
help:// URLs, they won't be needed anyways. The reasoning is that many
URLs not specifically pointing to man page directories will cause a
(non-deadly) unveil violation in `real_path_for`. This specifically
concerns the new application launch URLs that are added in the next
commit.
Previously the scroll position would not reset when loading a new
page. This caused various problems such as opening the page at the
previous pages scroll position and in some instances not even
showing the new page at all.
This is partially a revert of commits:
10a8b6d411561b67a1ad
Rather than adding the prot_exec pledge requried to use dlopen(), we can
link directly against LibUnicodeData in applications that we know need
that library.
This might make the dlopen() dance a bit unnecessary. The same purpose
might now be fulfilled with weak symbols. That can be revisted next, but
for now, this at least removes the potential security risk of apps like
the Browser having prot_exec privileges.
Given a command line with an ambiguous man page title, such as `$ Help
uname`, Help would find and try to open all matching pages, leading to
bad behavior such as a memory leak, flickering scrollbars, and
eventually a crash due to OOM. This commit fixes the issue by making
Help only open one page on startup.
I found it strange that `man` and `Help` did not accept the same command
line arguments since they are so similar. So... now they do. :^)
This means you can now open for example the `tar` man page in Help with
`Help tar`, or `Help 1 tar` if you want to disambiguate between pages in
different sections.
If the result is not found, it falls back to the previous behavior,
treating the input as a search query.
Initially I had this written as two optional positional arguments, but
when told to parse `[optional int] [optional string]`, and then given a
string input, ArgsParser forwards it to the [optional int], which then
fails to parse. Ideally it would pass it to the second, [optional
string] arg instead, but that looks like a fairly big change to make to
ArgsParser's internals, and risk breaking things. Maybe this ugly hack
will be an incentive to fix it. :^)
Previously, launching Help with a query like `Help tar` left the page
blank, which looks like something has gone wrong. Instead, let's show
the usual welcome page.
This patch makes use of all the new fallible APIs in LibGUI together
with TRY() to catch and propagate errors. The main error getting caught
is allocation failures while trying to construct the Help UI.
It's quite interesting to see how the code changes as more and more
fallible calls get branded as such by wrapping them in TRY().
There's a lot of repetitive "TRY(try_foo())" going on right now. Once
this becomes the dominant programming pattern, we can drop the "try_"
prefix everywhere. :^)
Only one place used this argument and it was to hold on to a strong ref
for the object. Since we already do that now, there's no need to keep
this argument around since this can be easily captured.
This commit contains no changes.
This allows for typing [8] instead of [8, 8, 8, 8] to specify the same
margin on all edges, for example. The constructors follow CSS' style of
specifying margins. The added constructors are:
- Margins(int all): Sets the same margin on all edges.
- Margins(int vertical, int horizontal): Sets the first argument to top
and bottom margins, and the second argument to left and right margins.
- Margins(int top, int vertical, int bottom): Sets the first argument to
the top margin, the second argument to the left and right margins,
and the third argument to the bottom margin.
Most of the models were just calling did_update anyway, which is
pointless since it can be unified to the base Model class. Instead, code
calling update() will now call invalidate(), which functions identically
and is more obvious in what it does.
Additionally, a default implementation is provided, which removes the
need to add empty implementations of update() for each model subclass.
Co-Authored-By: Ali Mohammad Pur <ali.mpfard@gmail.com>
Applications previously had to create a GUI::Menubar object, add menus
to it, and then call GUI::Window::set_menubar().
This patch introduces GUI::Window::add_menu() which creates the menubar
automatically and adds items to it. Application code becomes slightly
simpler as a result. :^)
Previously `open_page` was called multiple times when opening the
application, once for the actual page, but also in
`tree_view.on_selection_change`. At startup there is no valid selection
yet, which caused an empty page to be loaded. Prevent this by early
returning if the `path` is null.
Since the introduction of multi-select, we have had both `on_selection`
and `on_selection_change`, the latter of which was only invoked when a
change in selection came in through the model.
This removes `AbstractView::on_selection` and replaces it usage with
the more explicit `on_selection_change` everywhere.
Since applications using Core::EventLoop no longer need to create a
socket in /tmp/rpc/, and also don't need to listen for incoming
connections on this socket, we can remove a whole bunch of pledges!
Not sure why some menus did have one and others didn't, even in the
same application - now they all do. :^)
I added character shortcuts to some menu actions as well.
SPDX License Identifiers are a more compact / standardized
way of representing file license information.
See: https://spdx.dev/resources/use/#identifiers
This was done with the `ambr` search and replace tool.
ambr --no-parent-ignore --key-from-file --rep-from-file key.txt rep.txt *
I hereby declare these to be full nouns that we don't split,
neither by space, nor by underscore:
- Breadcrumbbar
- Coolbar
- Menubar
- Progressbar
- Scrollbar
- Statusbar
- Taskbar
- Toolbar
This patch makes everything consistent by replacing every other variant
of these with the proper one. :^)
(...and ASSERT_NOT_REACHED => VERIFY_NOT_REACHED)
Since all of these checks are done in release builds as well,
let's rename them to VERIFY to prevent confusion, as everyone is
used to assertions being compiled out in release.
We can introduce a new ASSERT macro that is specifically for debug
checks, but I'm doing this wholesale conversion first since we've
accumulated thousands of these already, and it's not immediately
obvious which ones are suitable for ASSERT.
Now that WindowServer broadcasts the system theme using an anonymous
file, we need clients to pledge "recvfd" so they can receive it.
Some programs keep the "shared_buffer" pledge since it's still used for
a handful of things.
