mirrors/rufus
1
0
Fork 0
mirror of https://github.com/pbatard/rufus.git synced 2025-05-20 18:05:21 -04:00
Code Issues Projects Releases Packages Wiki Activity

[net] add Windows retail ISO downloads

Browse source 
* This is accomplished through Fido (https://github.com/pbatard/Fido), a *SIGNED*
  PowerShell script, that is downloaded from GitHub and that resides in memory for
  the duration of a session.
* The reason we use a downloaded PS script, rather than an embedded on, is because:
  - Microsoft have regularly been changing the deal with regards to how retail ISOs
    can be downloaded, and not for the better, so we can't simply embed a static
    means of downloading ISOs and expect that to work forever.
  - By using an external script, we can immediately respond to whatever new means of
    *ANNOYING* their legitimate users Microsoft will come up with next, as well as
    make sure that, the minute a new retail version of Windows becomes available, it
    also becomes available for download in Rufus.
* Note that if you are concerned about downloading a remote PS script that is being
  run at the same level as an elevated application, you should understand that:
  - Only scripts downloaded from GitHub, from an account that is protected with 2FA,
    are allowed to run (i.e. someone would first have to steal a *physical* 2FA key
    to be in a position to upload a malicious script).
  - On top of this, only scripts that are signed with a separate private key (RSA +
    AES-256), that is itself also protected with a strong unique password which only
    a single person knows (and must manually enter each time they want to make a new
    version of the script available for download), are allowed to run.
  The above means that there's about as much chance for someone to manage to upload
  a malicious script on the GitHub servers, that Rufus would allow to run, as there
  is for someone to upload a malicious version of Rufus itself.
  Still, if you are paranoid and have concerns that, even as you can validate from
  its source that Rufus does not attempt to execute any remote script unless a user
  actively selected and clicked the DOWNLOAD button, you can also completely disable
  the remote script download feature, if you just set the update check to disabled
  (which, by the way, Rufus *EXPLICITLY* asks you to choose whether you want to
  enable or not, the very first time you run the application).
* Also remove _unlinkU() which duplicates what DeleteFileU() already does.
This commit is contained in:
Pete Batard 2019-03-02 23:28:56 +00:00
parent c5513447c9
commit e073fb47b0
No known key found for this signature in database
GPG key ID: 38E0CF5E69EDD671
14 changed files with 471 additions and 111 deletions
Download patch file Download diff file Expand all files Collapse all files

16
src/ui.c
View file

@ -1,7 +1,7 @@
/*
* Rufus: The Reliable USB Formatting Utility
* UI-related function calls
* Copyright © 2018 Pete Batard <pete@akeo.ie>
* Copyright © 2018-2019 Pete Batard <pete@akeo.ie>
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -43,6 +43,7 @@
UINT_PTR UM_LANGUAGE_MENU_MAX = UM_LANGUAGE_MENU;
HIMAGELIST hUpImageList, hDownImageList;
extern BOOL enable_fido;
int advanced_device_section_height, advanced_format_section_height;
// (empty) check box width, (empty) drop down width, button height (for and without dropdown match)
int cbw, ddw, ddbh = 0, bh = 0;
@ -147,6 +148,8 @@ void GetMainButtonsWidth(HWND hDlg)
{
unsigned int i;
RECT rc;
LONG style;
char download[64];
GetWindowRect(GetDlgItem(hDlg, main_button_ids[0]), &rc);
MapWindowPoints(NULL, hDlg, (POINT*)&rc, 2);
@ -154,8 +157,17 @@ void GetMainButtonsWidth(HWND hDlg)
for (i = 0; i < ARRAYSIZE(main_button_ids); i++)
bw = max(bw, GetTextWidth(hDlg, main_button_ids[i]) + cbw);
// The 'CLOSE' button is also be used to display 'CANCEL' => measure that too
// The 'CLOSE' button is also be used to display 'CANCEL' and we sometimes
// want to add "DOWNLOAD" into the Select split button => measure that too.
bw = max(bw, GetTextSize(GetDlgItem(hDlg, IDCANCEL), lmprintf(MSG_007)).cx + cbw);
if (enable_fido) {
static_strcpy(download, lmprintf(MSG_040));
CharUpperBuffU(download, sizeof(download));
bw = max(bw, GetTextSize(GetDlgItem(hDlg, IDC_SELECT), download).cx + (3 * cbw) / 2);
style = GetWindowLong(GetDlgItem(hDlg, IDC_SELECT), GWL_STYLE);
style|= BS_SPLITBUTTON;
SetWindowLong(GetDlgItem(hDlg, IDC_SELECT), GWL_STYLE, style);
}
}
// The following goes over the data that gets populated into the half-width dropdowns