From 1055187c8be280ddd9d22aa22282d396c98e7840 Mon Sep 17 00:00:00 2001
From: Simon Kornblith <simon@simonster.com>
Date: Thu, 25 Jul 2013 00:47:38 -0400
Subject: [PATCH] If Zotero is run as root, clobber the cache directory and
 show a warning

---
 .../content/zotero/standalone/standalone.js   | 27 +++++++++++++++++++
 chrome/locale/en-US/zotero/zotero.properties  |  3 +++
 2 files changed, 30 insertions(+)

diff --git a/chrome/content/zotero/standalone/standalone.js b/chrome/content/zotero/standalone/standalone.js
index 0d6e66698e..a94e812770 100644
--- a/chrome/content/zotero/standalone/standalone.js
+++ b/chrome/content/zotero/standalone/standalone.js
@@ -38,6 +38,7 @@ const ZoteroStandalone = new function() {
 			window.close();
 			return;
 		}
+		_checkRoot();
 		ZoteroPane.init();
 		ZoteroPane.makeVisible();
 		
@@ -146,6 +147,32 @@ const ZoteroStandalone = new function() {
 	this.onUnload = function() {
 		ZoteroPane.destroy();
 	}
+
+	/**
+	 * Warn if Zotero Standalone is running as root and clobber the cache directory
+	 */
+	function _checkRoot() {
+		if(!Zotero.isWin) {
+			var env = Components.classes["@mozilla.org/process/environment;1"].
+				getService(Components.interfaces.nsIEnvironment);
+			var user = env.get("USER") || env.get("USERNAME");
+			if(user === "root") {
+				// Zap cache files
+				try {
+					Services.dirsvc.get("ProfLD", Components.interfaces.nsIFile).remove(true);
+				} catch(e) {}
+				// Warn user never to do this again
+				if(Services.prompt.confirmEx(null, "", Zotero.getString("standalone.rootWarning"),
+						Services.prompt.BUTTON_POS_0*Services.prompt.BUTTON_TITLE_IS_STRING |
+						Services.prompt.BUTTON_POS_1*Services.prompt.BUTTON_TITLE_IS_STRING,
+						Zotero.getString("standalone.rootWarning.exit"),
+						Zotero.getString("standalone.rootWarning.continue"),
+						null, null, {}) == 0) {
+					goQuitApplication();
+				}
+			}
+		}
+	}
 }
 
 /** Taken from browser.js **/
diff --git a/chrome/locale/en-US/zotero/zotero.properties b/chrome/locale/en-US/zotero/zotero.properties
index 7635279f12..6a445f4cd2 100644
--- a/chrome/locale/en-US/zotero/zotero.properties
+++ b/chrome/locale/en-US/zotero/zotero.properties
@@ -934,6 +934,9 @@ locate.manageLocateEngines			= Manage Lookup Engines…
 standalone.corruptInstallation		= Your Zotero Standalone installation appears to be corrupted due to a failed auto-update. While Zotero may continue to function, to avoid potential bugs, please download the latest version of Zotero Standalone from http://zotero.org/support/standalone as soon as possible.
 standalone.addonInstallationFailed.title 	= Add-on Installation Failed
 standalone.addonInstallationFailed.body		= The add-on "%S" could not be installed. It may be incompatible with this version of Zotero Standalone.
+standalone.rootWarning				= You appear to be running Zotero Standalone as root. This is insecure and may prevent Zotero from functioning when launched from your user account.\n\nIf you wish to install an automatic update, modify the Zotero program directory to be writeable by your user account.
+standalone.rootWarning.exit			= Exit
+standalone.rootWarning.continue		= Continue
 
 connector.error.title				= Zotero Connector Error
 connector.standaloneOpen			= Your database cannot be accessed because Zotero Standalone is currently open. Please view your items in Zotero Standalone.