[fido] download an LZMA compressed version of the script

* Since we have compression available through Bled we might as well use it
* Also validate that the download URL comes from https://github.com/pbatard/Fido
* Also prevent the check for update from running while we are downloading ISOs
This commit is contained in:
Pete Batard 2019-03-23 13:59:20 +00:00
parent 7ad3b31be9
commit 4271e42b50
No known key found for this signature in database
GPG key ID: 38E0CF5E69EDD671
7 changed files with 112 additions and 20 deletions

View file

@ -1558,8 +1558,13 @@ BOOL SetUpdateCheck(void)
if ((loc_len != 0) && (loc_len < 4 * KB)) {
loc_len++; // DownloadToFileOrBuffer allocated an extra NUL character if needed
fido_url = get_token_data_buffer(FIDO_VERSION, 1, loc, (size_t)loc_len);
uprintf("Fido URL is %s", fido_url);
enable_fido = IsDownloadable(fido_url);
if (safe_strncmp(fido_url, "https://github.com/pbatard/Fido", 31) != 0) {
ubprintf("WARNING: Download script URL %s is invalid ✗", fido_url);
safe_free(fido_url);
} else {
uprintf("Fido URL is %s", fido_url);
enable_fido = IsDownloadable(fido_url);
}
}
safe_free(loc);
}