* Documentation/topdocs/NEWS.texi: Add note about safe mode.

* mf/GNUmakefile (FETA_LIST_FILES): Install feta*list.lys too.
This allows building the user manual using a binary installation
and a matching unpacked source tree.

* scm/lily.scm (safe-module): New variable.

* lily/includable-lexer.cc (new_input): Fix error messages.

* lily/parse-scm.cc (internal_ly_parse_scm): Add parameter SAFE.
If SAFE, evaluate in safe-module.  Change callers.

* lily/main.cc (Long_option_init): Reinstate safe-mode.

* lily/lexer.ll (embedded_scm): While processing main-input,
invoke ly_parse_scm with safe mode if running in safe-mode.
(<<EOF>>): Reset main_input_b_, fixes old-relative chech
in init.ly for safe-mode.

7 files changed, 45 insertions, 56 deletions

diff --git a/lily/includable-lexer.cc b/lily/includable-lexer.cc
index 9293970425..fd2a2de4dc 100644
--- a/lily/includable-lexer.cc
+++ b/lily/includable-lexer.cc
@@ -47,7 +47,7 @@ Includable_lexer::new_input (String s, Sources  * global_sources)
 {
   if (!allow_includes_b_)
     {
-      LexerError ("include files are disallowed.");
+      LexerError (_ ("include files are not allowed").to_str0 ());
       return;
     }
   
diff --git a/lily/include/parse-scm.hh b/lily/include/parse-scm.hh
index 896559ea02..3d0158fab8 100644
--- a/lily/include/parse-scm.hh
+++ b/lily/include/parse-scm.hh
@@ -15,8 +15,8 @@ struct Parse_start
 };
 
 SCM catch_protected_parse_body (void *);
-SCM protected_ly_parse_scm (Parse_start *);
+SCM protected_ly_parse_scm (Parse_start *, bool);
 
-SCM ly_parse_scm (char const* s, int *, Input);
+SCM ly_parse_scm (char const *, int *, Input, bool);
 
 #endif
diff --git a/lily/lexer.ll b/lily/lexer.ll
index c2cb3077ca..1c859e27a4 100644
--- a/lily/lexer.ll
+++ b/lily/lexer.ll
@@ -206,6 +206,7 @@ HYPHEN		--
 	}
 	<<EOF>> 	{
 		LexerError (_ ("EOF found inside a comment").to_str0 ());
+		main_input_b_ = false;
 		if (! close_input ()) 
 		  yyterminate (); // can't move this, since it actually rets a YY_NULL
 	}
@@ -219,7 +220,7 @@ HYPHEN		--
 		main_input_b_ = true;
 	}
 	else
-		error (_ ("\\maininput disallowed outside init files"));
+		error (_ ("\\maininput not allowed outside init files"));
 }
 
 <INITIAL,chords,lyrics,figures,notes>\\include           {
@@ -286,17 +287,14 @@ HYPHEN		--
 	//char const* s = YYText () + 1;
 	char const* s = here_str0 ();
 	int n = 0;
-	if (main_input_b_ && safe_global_b) {
-		error (_ ("Can't evaluate Scheme in safe mode"));
-		yylval.scm =  SCM_EOL;
-		return SCM_T;
-	}
-	SCM sval = ly_parse_scm (s, &n, here_input());
+	SCM sval = ly_parse_scm (s, &n, here_input (),
+		safe_global_b && main_input_b_);
+
 	if (sval == SCM_UNDEFINED)
-		{
+	{
 		sval = SCM_UNSPECIFIED;
 		errorlevel_ = 1;
-		}
+ 	}
 
 	for (int i=0; i < n; i++)
 	{
@@ -529,8 +527,7 @@ HYPHEN		--
 }
 
 <<EOF>> {
-
-
+	main_input_b_ = false;
 	if (! close_input ()) { 
  	  yyterminate (); // can't move this, since it actually rets a YY_NULL
 	}
diff --git a/lily/ly-module.cc b/lily/ly-module.cc
index ae8cedddf6..905940d72a 100644
--- a/lily/ly-module.cc
+++ b/lily/ly-module.cc
@@ -19,7 +19,7 @@ static int module_count;
 void
 ly_init_anonymous_module (void * data)
 {
-  scm_c_use_module ("lily");  
+  scm_c_use_module ("lily");
 }
 
 Protected_scm anon_modules;
@@ -29,7 +29,6 @@ ly_make_anonymous_module ()
 {
   String s = "*anonymous-ly-" + to_string (module_count++) +  "*";
   SCM mod = scm_c_define_module (s.to_str0(), ly_init_anonymous_module, 0);
-
   anon_modules = scm_cons (mod, anon_modules);
   return mod;
 }
diff --git a/lily/main.cc b/lily/main.cc
index 5d88928cc7..11a97fb92c 100644
--- a/lily/main.cc
+++ b/lily/main.cc
@@ -64,7 +64,7 @@ String output_format_global = "tex";
 /* Current output name. */
 String output_name_global;
 
-/* Run in safe mode? -- FIXME: should be re-analised */
+/* Run in safe mode? */
 bool safe_global_b = false;
 
 /* Verbose progress indication? */
@@ -118,12 +118,7 @@ static Long_option_init options_static[] = {
   {0, "no-paper", 'm',  _i ("produce MIDI output only")},
   {_i ("FILE"), "output", 'o',  _i ("write output to FILE")},
   {_i ("DIR"), "dep-prefix", 'P',  _i ("prepend DIR to dependencies")},
-#if 0
-  /*
-    should audit again.
-   */
-  {0, "safe", 's',  _i ("inhibit file output naming and exporting")},
-#endif
+  {0, "safe-mode", 's',  _i ("run in safe mode")},
   {0, "version", 'v',  _i ("print version number")},
   {0, "verbose", 'V', _i ("be verbose")},
   {0, "warranty", 'w',  _i ("show warranty and copyright")},
diff --git a/lily/my-lily-lexer.cc b/lily/my-lily-lexer.cc
index 2a8d3e8cb5..9eead743d7 100644
--- a/lily/my-lily-lexer.cc
+++ b/lily/my-lily-lexer.cc
@@ -113,7 +113,7 @@ My_lily_lexer::My_lily_lexer ()
 void
 My_lily_lexer::add_scope (SCM module)
 {
-  ly_reexport_module (scm_current_module());
+  ly_reexport_module (scm_current_module ());
   scm_set_current_module (module);
   for (SCM s = scopes_; gh_pair_p (s); s = gh_cdr (s))
     {
@@ -166,11 +166,11 @@ void
 My_lily_lexer::start_main_input ()
 {  
   new_input (main_input_name_, &global_input_file->sources_);
-  allow_includes_b_ = allow_includes_b_ &&  ! (safe_global_b);
+  allow_includes_b_ = allow_includes_b_ && ! safe_global_b;
 
   scm_module_define (gh_car (scopes_),
 		     ly_symbol2scm ("input-file-name"),
-		     scm_makfrom0str (main_input_name_.to_str0()));
+		     scm_makfrom0str (main_input_name_.to_str0 ()));
 }
 
 void
diff --git a/lily/parse-scm.cc b/lily/parse-scm.cc
index 3204dec58a..d5628707e6 100644
--- a/lily/parse-scm.cc
+++ b/lily/parse-scm.cc
@@ -14,7 +14,7 @@
   Need guile-1.3.4 (>1.3 anyway) for ftell on str ports -- jcn
 */
 SCM
-internal_ly_parse_scm (Parse_start * ps)
+internal_ly_parse_scm (Parse_start * ps, bool safe)
 {
   Source_file* sf =ps->start_location_.source_file_;
   SCM port = sf->get_port();
@@ -29,25 +29,18 @@ internal_ly_parse_scm (Parse_start * ps)
 
   /* Read expression from port */
   if (!SCM_EOF_OBJECT_P (form = scm_read (port)))
-    answer = scm_primitive_eval (form);
+    {
+      if (safe)
+	{
+	  SCM safe_module = scm_primitive_eval (ly_symbol2scm ("safe-module"));
+	  answer = scm_eval (form, safe_module);
+	}
+      else
+	answer = scm_primitive_eval (form);
+    }
  
-  /*
-   After parsing
-
- (begin (foo 1 2))
-
-   all seems fine, but after parsing
-
- (foo 1 2)
-
-   read_buf has been advanced to read_pos - 1,
-   so that scm_ftell returns 1, instead of #parsed chars
-   */
-  
-  /*
-    urg: reset read_buf for scm_ftell
-    shouldn't scm_read () do this for us?
-  */
+  /* Reset read_buf for scm_ftell.
+     Shouldn't scm_read () do this for us?  */
   scm_fill_input (port);
   SCM to = scm_ftell (port);
   ps->nchars = gh_scm2int (to) - gh_scm2int (from);
@@ -55,20 +48,24 @@ internal_ly_parse_scm (Parse_start * ps)
   /* Don't close the port here; if we re-enter this function via a
      continuation, then the next time we enter it, we'll get an error.
      It's a string port anyway, so there's no advantage to closing it
-     early.
-
-     scm_close_port (port);
-  */
+     early. */
+  // scm_close_port (port);
 
   return answer;
 }
 
-
 SCM
 catch_protected_parse_body (void *p)
 {
   Parse_start *ps = (Parse_start*) p;
-  return internal_ly_parse_scm (ps);
+  return internal_ly_parse_scm (ps, false);
+}
+
+SCM
+safe_catch_protected_parse_body (void *p)
+{
+  Parse_start *ps = (Parse_start*) p;
+  return internal_ly_parse_scm (ps, true);
 }
 
 SCM 
@@ -103,10 +100,11 @@ parse_handler (void * data, SCM tag, SCM args)
 #endif
 
 SCM
-protected_ly_parse_scm (Parse_start *ps)
+protected_ly_parse_scm (Parse_start *ps, bool safe)
 {
   return scm_internal_catch (ly_symbol2scm (READ_ERROR),
-			     &catch_protected_parse_body,
+			     (safe ? &safe_catch_protected_parse_body
+			      : catch_protected_parse_body),
 			     (void*)ps,
 			     &parse_handler, (void*)ps);
 }
@@ -117,15 +115,15 @@ bool  parse_protect_global  = true;
   Try parsing. If failure, then return SCM_UNDEFINED.
  */
 SCM
-ly_parse_scm (char const* s, int *n, Input i)
+ly_parse_scm (char const* s, int *n, Input i, bool safe)
 {
   
   Parse_start ps ;
   ps.str = s;
   ps.start_location_ = i;
 
-  SCM ans = parse_protect_global ? protected_ly_parse_scm (&ps)
-    : internal_ly_parse_scm (&ps);
+  SCM ans = parse_protect_global ? protected_ly_parse_scm (&ps, safe)
+    : internal_ly_parse_scm (&ps, safe);
   *n = ps.nchars;
 
   return ans;