mirror of
https://github.com/storytold/figcraft.git
synced 2026-11-08 19:42:05 +00:00
The confirmation showed the directory entry's access and commands, but the downloaded bundle's manifest was registered as is, so a directory could show a read-only plugin and install one that edits the document. A manifest asking for more than the entry showed is refused before it is saved.