add: saving script action warning

README.md

@@ -160,7 +160,7 @@ An action has the following settings:
 ### Custom script
 
 > ⚠️ **Warning**: Custom script is a powerful feature. It can do anything that you can do in the Zotero client. Use it with caution!
-> 
+>
 > All the scripts shared in the [community](https://github.com/windingwind/zotero-actions-tags/discussions/categories/action-scripts) will be manually reviewed by me to make sure it is not malicious. However, they may still cause data loss if you does not use them properly!
 > Do not run the script that you do not trust!
 

addon/chrome/content/preferences.xhtml

@@ -23,6 +23,13 @@
         class="rule-selection"
       ></button>
     </hbox>
+    <hbox>
+      <checkbox
+        preference="__prefsPrefix__.ruleWarningDisabled"
+        native="true"
+        data-l10n-id="prefs-script-warning-ignore"
+      ></checkbox>
+    </hbox>
   </groupbox>
   <html:label
     data-l10n-id="pref-help"

addon/locale/en-US/addon.ftl

@@ -33,5 +33,7 @@ prefs-rule-edit-shortcut-empty = No Shortcut
 prefs-rule-edit-shortcut-placeholder = Press to record shortcut
 prefs-rule-edit-menu-placeholder = Leave empty to hide in menu
 
+prefs-script-warning = ⚠️ Warning: This script will be executed with full access to your computer. Only use scripts from trusted sources. Are you sure you want to continue?
+
 menupopup-label = Trigger Action
 menupopup-placeholder = No actions

addon/locale/en-US/preferences.ftl

@@ -19,3 +19,6 @@ prefs-rule-operation-add = Add Tags
 prefs-rule-operation-remove = Remove Tags
 prefs-rule-operation-toggle = Toggle Tags
 prefs-rule-operation-script = Script
+
+prefs-script-warning-ignore =
+    .label = Don't show warning when saving script actions

addon/locale/zh-CN/addon.ftl

@@ -33,5 +33,7 @@ prefs-rule-edit-shortcut-empty = 无快捷键
 prefs-rule-edit-shortcut-placeholder = 按下键盘以记录快捷键
 prefs-rule-edit-menu-placeholder = 若为空则不显示菜单项
 
+prefs-script-warning = ⚠️ 警告: 该脚本将在对您计算机具有完全权限的情况下执行。请仅使用您信任的脚本。是否确认继续？
+
 menupopup-label = 触发动作
 menupopup-placeholder = 无可用动作

addon/locale/zh-CN/preferences.ftl

@@ -19,3 +19,6 @@ prefs-rule-operation-add = 添加标签
 prefs-rule-operation-remove = 移除标签
 prefs-rule-operation-toggle = 切换标签
 prefs-rule-operation-script = 自定义脚本
+
+prefs-script-warning-ignore =
+    .label = 在保存自定义脚本时不显示警告

addon/prefs.js

@@ -1,2 +1,3 @@
 /* eslint-disable no-undef */
 pref("__prefsPrefix__.rulesInit", false);
+pref("__prefsPrefix__.ruleWarningDisabled", false);

src/modules/preferenceWindow.ts

@@ -10,6 +10,7 @@ import {
 import { closeWindow, isWindowAlive } from "../utils/window";
 import { KeyModifier } from "../utils/shorcut";
 import { waitUtilAsync } from "../utils/wait";
+import { getPref } from "../utils/prefs";
 
 export async function initPrefPane(_window: Window) {
   // This function is called when the prefs window is opened
@@ -29,7 +30,7 @@ async function initUI() {
   const renderLock = Zotero.Promise.defer();
   if (!isWindowAlive(addon.data.prefs.window)) return;
   addon.data.prefs.tableHelper = new ztoolkit.VirtualizedTable(
-    addon.data.prefs.window!,
+    addon.data.prefs.window!
   )
     .setContainerId(`${config.addonRef}-table-container`)
     .setProp({
@@ -131,7 +132,7 @@ function initEvents() {
     .querySelector(`#${config.addonRef}-rule-add`)
     ?.addEventListener("command", (e) => {
       const key = addon.api.actionManager.updateAction(
-        Object.assign({}, emptyAction),
+        Object.assign({}, emptyAction)
       );
       updateUI();
       editAction(key);
@@ -166,7 +167,7 @@ function getRowData(index: number) {
   return {
     event: getString(`prefs-rule-event-${ActionEventTypes[action.event]}`),
     operation: getString(
-      `prefs-rule-operation-${ActionOperationTypes[action.operation]}`,
+      `prefs-rule-operation-${ActionOperationTypes[action.operation]}`
     ),
     data: action.data,
     shortcut: action.shortcut,
@@ -305,7 +306,7 @@ async function editAction(currentKey?: string) {
                     const content = await openEditorWindow(dialogData.data);
                     (
                       dialog.window.document.querySelector(
-                        "#data-input",
+                        "#data-input"
                       ) as HTMLTextAreaElement
                     ).value = content;
                     dialogData.data = content;
@@ -339,7 +340,7 @@ async function editAction(currentKey?: string) {
                 const key = ev.target as HTMLElement;
                 const win = dialog.window;
                 key.textContent = `[${getString(
-                  "prefs-rule-edit-shortcut-placeholder",
+                  "prefs-rule-edit-shortcut-placeholder"
                 )}]`;
                 dialogData.shortcut = "";
                 const keyDownListener = (e: KeyboardEvent) => {
@@ -425,6 +426,13 @@ async function editAction(currentKey?: string) {
   switch (dialogData._lastButtonId) {
     case "save":
       {
+        if (
+          Number(dialogData.operation) === ActionOperationTypes.script &&
+          !getPref("ruleWarningDisabled") &&
+          !win?.confirm(getString("prefs-script-warning"))
+        ) {
+          break;
+        }
         addon.api.actionManager.updateAction(
           {
             event: Number(dialogData.event),
@@ -437,7 +445,7 @@ async function editAction(currentKey?: string) {
             menu: dialogData.menu,
             name: dialogData.name,
           },
-          currentKey,
+          currentKey
         );
         updateUI();
       }
@@ -454,7 +462,7 @@ async function openEditorWindow(content: string) {
   const editorWin = addon.data.prefs.window?.openDialog(
     "chrome://scaffold/content/monaco/monaco.html",
     "monaco",
-    "chrome,centerscreen,dialog=no,resizable,scrollbars=yes,width=800,height=600",
+    "chrome,centerscreen,dialog=no,resizable,scrollbars=yes,width=800,height=600"
   ) as
     | (Window & {
         loadMonaco: (options: Record<string, any>) => Promise<{ editor: any }>;