To: vim_dev@googlegroups.com
Subject: Patch 8.1.0540
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------

Patch 8.1.0540
Problem:    May evaluate insecure value when appending to option.
Solution:   Set the secure flag when changing an option that was previously
            set insecurely.  Also allow numbers for the characters from
            'spelllang' that are used for LANG.vim. (closes #3623)
Files:	    src/option.c


*** ../vim-8.1.0539/src/option.c	2018-11-20 13:32:30.276983764 +0100
--- src/option.c	2018-11-20 14:16:31.077302001 +0100
***************
*** 4705,4710 ****
--- 4706,4713 ----
  	    }
  	    else
  	    {
+ 		int value_is_replaced = !prepending && !adding && !removing;
+ 
  		if (flags & P_BOOL)		    /* boolean */
  		{
  		    if (nextchar == '=' || nextchar == ':')
***************
*** 5209,5220 ****
  			}
  #endif
  
! 			/* Handle side effects, and set the global value for
! 			 * ":set" on local options. Note: when setting 'syntax'
! 			 * or 'filetype' autocommands may be triggered that can
! 			 * cause havoc. */
! 			errmsg = did_set_string_option(opt_idx, (char_u **)varp,
! 				new_value_alloced, oldval, errbuf, opt_flags);
  
  #if defined(FEAT_EVAL)
  			if (errmsg == NULL)
--- 5212,5247 ----
  			}
  #endif
  
! 			{
! 			    long_u *p = insecure_flag(opt_idx, opt_flags);
! 			    int	    did_inc_secure = FALSE;
! 
! 			    // When an option is set in the sandbox, from a
! 			    // modeline or in secure mode, then deal with side
! 			    // effects in secure mode.  Also when the value was
! 			    // set with the P_INSECURE flag and is not
! 			    // completely replaced.
! 			    if (secure
! #ifdef HAVE_SANDBOX
! 				    || sandbox != 0
! #endif
! 				    || (opt_flags & OPT_MODELINE)
! 				    || (!value_is_replaced && (*p & P_INSECURE)))
! 			    {
! 				did_inc_secure = TRUE;
! 				++secure;
! 			    }
! 
! 			    // Handle side effects, and set the global value for
! 			    // ":set" on local options. Note: when setting 'syntax'
! 			    // or 'filetype' autocommands may be triggered that can
! 			    // cause havoc.
! 			    errmsg = did_set_string_option(opt_idx, (char_u **)varp,
! 				    new_value_alloced, oldval, errbuf, opt_flags);
! 
! 			    if (did_inc_secure)
! 				--secure;
! 			}
  
  #if defined(FEAT_EVAL)
  			if (errmsg == NULL)
***************
*** 5254,5261 ****
  		}
  
  		if (opt_idx >= 0)
! 		    did_set_option(opt_idx, opt_flags,
! 					 !prepending && !adding && !removing);
  	    }
  
  skip:
--- 5281,5287 ----
  		}
  
  		if (opt_idx >= 0)
! 		    did_set_option(opt_idx, opt_flags, value_is_replaced);
  	    }
  
  skip:
***************
*** 7758,7764 ****
  	     * '.encoding'.
  	     */
  	    for (p = q; *p != NUL; ++p)
! 		if (!ASCII_ISALPHA(*p) && *p != '-')
  		    break;
  	    if (p > q)
  	    {
--- 7784,7790 ----
  	     * '.encoding'.
  	     */
  	    for (p = q; *p != NUL; ++p)
! 		if (!ASCII_ISALNUM(*p) && *p != '-')
  		    break;
  	    if (p > q)
  	    {
*** ../vim-8.1.0539/src/version.c	2018-11-20 13:32:30.276983764 +0100
--- src/version.c	2018-11-20 14:21:13.067051824 +0100
***************
*** 794,795 ****
--- 794,797 ----
  {   /* Add new patch number below this line */
+ /**/
+     540,
  /**/

-- 
A hamburger walks into a bar, and the bartender says: "I'm sorry,
but we don't serve food here."

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\  an exciting new programming language -- http://www.Zimbu.org        ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///