@@ -108,6 +108,22 @@ void CLuaMain::ResetInstructionCount(void)
108108
109109void CLuaMain::InitSecurity (void )
110110{
111+ // Disable dangerous Lua Os library functions
112+ lua_getglobal (m_luaVM, " os" );
113+ lua_pushnil (m_luaVM);
114+ lua_setfield (m_luaVM, -2 , " execute" );
115+ lua_pushnil (m_luaVM);
116+ lua_setfield (m_luaVM, -2 , " rename" );
117+ lua_pushnil (m_luaVM);
118+ lua_setfield (m_luaVM, -2 , " remove" );
119+ lua_pushnil (m_luaVM);
120+ lua_setfield (m_luaVM, -2 , " exit" );
121+ lua_pushnil (m_luaVM);
122+ lua_setfield (m_luaVM, -2 , " getenv" );
123+ lua_pushnil (m_luaVM);
124+ lua_setfield (m_luaVM, -2 , " tmpname" );
125+ lua_pop (m_luaVM, 1 );
126+
111127 lua_register (m_luaVM, " dofile" , CLuaUtilDefs::DisabledFunction);
112128 lua_register (m_luaVM, " loadfile" , CLuaUtilDefs::DisabledFunction);
113129 lua_register (m_luaVM, " require" , CLuaUtilDefs::DisabledFunction);
@@ -174,22 +190,6 @@ void CLuaMain::InitVM(void)
174190 luaopen_utf8 (m_luaVM);
175191 luaopen_os (m_luaVM);
176192
177- // Disable dangerous Lua Os library functions
178- lua_getglobal (m_luaVM, " os" );
179- lua_pushnil (m_luaVM);
180- lua_setfield (m_luaVM, -2 , " execute" );
181- lua_pushnil (m_luaVM);
182- lua_setfield (m_luaVM, -2 , " rename" );
183- lua_pushnil (m_luaVM);
184- lua_setfield (m_luaVM, -2 , " remove" );
185- lua_pushnil (m_luaVM);
186- lua_setfield (m_luaVM, -2 , " exit" );
187- lua_pushnil (m_luaVM);
188- lua_setfield (m_luaVM, -2 , " getenv" );
189- lua_pushnil (m_luaVM);
190- lua_setfield (m_luaVM, -2 , " tmpname" );
191- lua_pop (m_luaVM, 1 );
192-
193193 // Initialize security restrictions. Very important to prevent lua trojans and viruses!
194194 InitSecurity ();
195195
0 commit comments