From 2a9e065cfb896d0405e8011907d41125b4b6b4a7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jonas=20Dre=C3=9Fler?= <verdre@v0yd.nl>
Date: Wed, 11 Sep 2019 20:24:17 +0200
Subject: [PATCH] extensionSystem: Always enforce disallowing extensions using
 sessionMode

It's currently possible to circumvent the `sessionMode.allowExtensions`
property: For already enabled extensions one can call reloadExtension
via DBus, for new extensions it's possible by adding the extension to
the enabled-extensions gsettings key and setting the
disable-extension-version-validation key (which triggers a reload of
`this._enabledExtensions`) and then calling reloadExtension via DBus.

So to enforce `allowExtensions` while still allowing to update
extensions and keeping the extensionSystem synced with various gsettings
keys, replace the checks for `this._enabled` with simple checks for
`Main.sessionMode.allowExtensions` inside `_callExtensionInit()` and
`_callExtensionEnable()`.

The remaining checks for `this._enabled` are only small optimizations to
prevent running code on irrelevant sessionMode updates.

https://gitlab.gnome.org/GNOME/gnome-shell/merge_requests/96
---
 js/ui/extensionSystem.js | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/js/ui/extensionSystem.js b/js/ui/extensionSystem.js
index 99777a631..d14956810 100644
--- a/js/ui/extensionSystem.js
+++ b/js/ui/extensionSystem.js
@@ -98,6 +98,9 @@ var ExtensionManager = class {
     }
 
     _callExtensionEnable(uuid) {
+        if (!Main.sessionMode.allowExtensions)
+            return;
+
         let extension = this.lookup(uuid);
         if (!extension)
             return;
@@ -302,6 +305,9 @@ var ExtensionManager = class {
     }
 
     _callExtensionInit(uuid) {
+        if (!Main.sessionMode.allowExtensions)
+            return;
+
         let extension = this.lookup(uuid);
         if (!extension)
             throw new Error("Extension was not properly created. Call createExtensionObject first");
@@ -385,9 +391,6 @@ var ExtensionManager = class {
     _onEnabledExtensionsChanged() {
         let newEnabledExtensions = this._getEnabledExtensions();
 
-        if (!this._enabled)
-            return;
-
         // Find and enable all the newly enabled extensions: UUIDs found in the
         // new setting, but not in the old one.
         newEnabledExtensions.filter(
@@ -426,11 +429,9 @@ var ExtensionManager = class {
             this.reloadExtension(extension);
         this._enabledExtensions = this._getEnabledExtensions();
 
-        if (Main.sessionMode.allowExtensions) {
-            this._enabledExtensions.forEach(uuid => {
-                this._callExtensionEnable(uuid);
-            });
-        }
+        this._enabledExtensions.forEach(uuid => {
+            this._callExtensionEnable(uuid);
+        });
     }
 
     _loadExtensions() {