security: don't let renderer know custom vencord path

It's best not to let the renderer know about the system's file structure.
In case of a vulnerability allowing arbitrary file writes, this would make it considerably easier to overwrite critical files
This commit is contained in:
Vendicated
2026-01-07 22:57:23 +01:00
parent 0f509b002d
commit 786c3cc196
4 changed files with 18 additions and 13 deletions
@@ -56,21 +56,21 @@ function openDeveloperOptionsModal(settings: Settings) {
const VencordLocationPicker: SettingsComponent = ({ settings }) => {
const forceUpdate = useForceUpdater();
const vencordDir = VesktopNative.fileManager.getVencordDir();
const usingCustomVencordDir = VesktopNative.fileManager.isUsingCustomVencordDir();
return (
<>
<Paragraph>
Vencord files are loaded from{" "}
{vencordDir ? (
{usingCustomVencordDir ? (
<TextButton
variant="link"
onClick={e => {
e.preventDefault();
VesktopNative.fileManager.showItemInFolder(vencordDir!);
VesktopNative.fileManager.showCustomVencordDir();
}}
>
{vencordDir}
a custom location
</TextButton>
) : (
"the default location"