I fixed a bug in $thing.will_move(): it was checking
.trusts(sender()) which makes no sense because the sender would be the
object itself if it was called from .move_to(), and it was causing
a disparity between the result of calling .move_to() and .will_move(),
making it impossible to check before trying to move an object whether
the object in fact could be moved.
I simply commented out the entire check, because I have no idea what
the intent was. This could not possibly introduce a security hole,
because when called from .move_to() it's a no-op, and .move_to() is
the only thing that currently calls .will_move(). Of course, if an
object doesn't trust itself, this would mean the object could still
move itself, but I don't think this is a problem, since it is possible
to lock an object to only its trusted parties.
Have a nice day!
--Sean
|