mirror of
https://github.com/storytold/figcraft.git
synced 2026-11-12 08:51:11 +00:00
The confirmation showed the directory entry's access and commands, but the downloaded bundle's manifest was registered as is, so a directory could show a read-only plugin and install one that edits the document. A manifest asking for more than the entry showed is refused before it is saved.