[gnome-shell/wip/rstrode/login-screen-extensions: 60/134] extensionDownloader: Refuse to override system extensions

[Ray Strode <halfline src gnome org>]

commit e68aaa8449c11e4e32d29ace2f3a9871827fa93d
Author: Florian Müllner <fmuellner gnome org>
Date:   Mon Feb 1 18:26:00 2021 +0100

    extensionDownloader: Refuse to override system extensions
    
    The website allows to "update" system extensions by installing the
    upstream version into the user's home directory.
    
    Prevent that by refusing to download and install extensions that are
    already installed system-wide.

 js/ui/extensionDownloader.js | 8 ++++++++
 1 file changed, 8 insertions(+)
---
diff --git a/js/ui/extensionDownloader.js b/js/ui/extensionDownloader.js
index 0bd77e1256..1e6f5340a6 100644
--- a/js/ui/extensionDownloader.js
+++ b/js/ui/extensionDownloader.js
@@ -16,6 +16,14 @@ var REPOSITORY_URL_UPDATE   = REPOSITORY_URL_BASE + '/update-info/';
 let _httpSession;
 
 function installExtension(uuid, invocation) {
+    const oldExt = Main.extensionManager.lookup(uuid);
+    if (oldExt && oldExt.type === ExtensionUtils.ExtensionType.SYSTEM) {
+        log('extensionDownloader: Trying to replace system extension %s'.format(uuid));
+        invocation.return_dbus_error('org.gnome.Shell.InstallError',
+            'System extensions cannot be replaced');
+        return;
+    }
+
     let params = { uuid: uuid,
                    shell_version: Config.PACKAGE_VERSION };