[outdated] dreaded "attempt to access a private function UseItem from insecure code"

[merlight]

Please add hook points to ZO_InventorySlot_DiscoverSlotActionsFromActionList

function ZO_InventorySlot_DiscoverSlotActionsFromActionList(inventorySlot, slotActions)
    CALLBACK_MANAGER:FireCallbacks("Pre_InventorySlot_DiscoverSlotActions", inventorySlot, slotActions)
    ...
    CALLBACK_MANAGER:FireCallbacks("Post_InventorySlot_DiscoverSlotActions", inventorySlot, slotActions)
end

edit: or fire those callbacks in PerClickInitializeActions, so that if some add-ons pre-hook ZO_InventorySlot_DiscoverSlotActionsFromActionList the "Pre_" callback is actually called before the function, and not between the hook and the original.

We could probably achieve the same by hooking ZO_InventorySlotActions:SetContextMenuMode and ZO_InventorySlotActions:Show as long as ZO_InventorySlot_ShowContextMenu/PerClickInitializeActions are unchanged, but... ugh!

I have an add-on I wrote like 16 months ago that does ZO_PreHook("ZO_InventorySlot_DiscoverSlotActionsFromActionList", addMySlotAction), and works fine (well at least since the patch where you started creating some context menu entries in advance). Now I'm writing something completely different, and wanted to post-hook that function in order to add menu entries at the bottom rather than top. But that reliably causes an error on 'UseItem'. I checked some add-ons that hook ZO_InventorySlot_DiscoverSlotActionsFromActionList or ZO_InventorySlot_ShowContextMenu, and was kinda shocked -- they ZO_PreHook and zo_callLater to add their stuff to the context menu with a delay.

Try this, and then use an item from inventory (good test subjects are writ containers with auto-loot off)

/script ZO_PreHook("ZO_InventorySlot_DiscoverSlotActionsFromActionList", function(s) df("good hook %s", tostring(s.slotIndex)) end)
-- pre-hook works, no error

Now try this:

/script local org = ZO_InventorySlot_DiscoverSlotActionsFromActionList; function ZO_InventorySlot_DiscoverSlotActionsFromActionList(s, a) df("evil hook %s", tostring(s.slotIndex), org(s, a)) end
-- post-hook causes insecure code error

My theory is that pre-hook works because the wrapper function created by ZO_PreHook calls the original function in a return statement -- the tail call replaces the (insecure) wrapper on the call stack and so is allowed to call protected functions. Well, even if that is true, there's no way around it other than providing a hook point inside the original function.

Note: this has nothing to do with AddMenuItem / LibCustomMenu. The evil hook is empty, it doesn't add anything and still causes error.

[votan]

Originally Posted by merlight My theory is that pre-hook works because the wrapper function created by ZO_PreHook calls the original function in a return statement -- the tail call replaces the (insecure) wrapper on the call stack and so is allowed to call protected functions. Well, even if that is true, there's no way around it other than providing a hook point inside the original function.

This is what I observed, too. Look here.