Index: class.c ================================================================== --- class.c +++ class.c @@ -612,12 +612,18 @@ if(!inpstack) fatal("Allocation failed\n"); inpstack->classfp=classfp; inpstack->linenum=linenum; inpstack->next=nxt; linenum=1; - //TODO: Use the correct directory to load the include file - classfp=fopen(name,"r"); + if(*name=='.' || *name=='_' || *name=='-' || !*name || name[strspn(name,"0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-")]) + ParseError("Improper name of include file \"%s\"\n",name); + if(main_options['z']) { + if(strlen(name)<9 || memcmp(name-strlen(name),".include",8)) ParseError("Include file name doesn't end with .include\n"); + classfp=composite_slice(name,0)?:fopen(name,"r"); + } else { + classfp=fopen(name,"r"); + } if(!classfp) ParseError("Cannot open include file \"%s\": %m\n",name); } static void begin_macro(TokenList*mac) { MacroStack*ms=malloc(sizeof(MacroStack)); Index: class.doc ================================================================== --- class.doc +++ class.doc @@ -188,11 +188,16 @@ not be another macro). The token is expanded, and must be a single token once it is expanded; that is what it will be replaced with. {include } Include text from another file into this one. You cannot use {include} - inside of another macro or in a macro argument. + inside of another macro or in a macro argument. The file must be in the + current directory, and its name must contain only letters, digits, dot, + underscore, and minus signs, and must start with a letter or digit. If + it is a composite puzzle set, then the name must end with ".include", + and is looked for first inside of the composite puzzle set; if it is not + found there then it is looked for in the current directory. {make } Make a synthetic token; see the below section about synthetic tokens for details. The second argument can be a number, or a direction or key name which is treated as a number, or a string. In most cases, a number will