tools: do not save or load levels outside the source directory

docs/changelog.rst

@@ -14,9 +14,11 @@ Changelog
 **Tools**
 
 * Added the Project Browser
+* Added the Statusbar
+* Fixed an issue that allowed the Level Editor to load or save levels outside the source directory
 * Fixed an issue that allowed the user to enter blank names when renaming objects in the Level Tree
-* Fixed an issue that caused the Level Editor to not include "core/units/camera" in the boot.package of a newly created project
 * Fixed an issue that caused level auto-saving in Level Editor not triggering at the intended interval
+* Fixed an issue that caused the Level Editor to not include "core/units/camera" in the boot.package of a newly created project
 * Renaming of objects in the Level Tree is now handled with a modal dialog
 * Unified the asset import dialogs
 

tools/level_editor/level_editor.vala

@@ -1076,18 +1076,17 @@ namespace Crown
 			if (filename == "")
 				return;
 
-			if (filename.has_prefix(_project.source_dir()))
+			if (!_project.path_is_within_dir(filename, _project.source_dir()))
 			{
-				if (filename.has_suffix(".level") && filename != _level._filename)
-				{
-					_level.load(filename);
-					_level.send_level();
-					send_state();
-				}
+				_console_view.loge("editor", "File must be within `%s`".printf(_project.source_dir()));
+				return;
 			}
-			else
+
+			if (filename.has_suffix(".level") && filename != _level._filename)
 			{
-				_console_view.loge("editor", "File must be within `%s`".printf(_project.source_dir()));
+				_level.load(filename);
+				_level.send_level();
+				send_state();
 			}
 		}
 
@@ -1151,7 +1150,7 @@ namespace Crown
 				fcd.destroy();
 			}
 
-			if (!path.has_prefix(_project.source_dir()))
+			if (!_project.path_is_within_dir(path, _project.source_dir()))
 			{
 				_console_view.loge("editor", "File must be within `%s`".printf(_project.source_dir()));
 				return false;

tools/level_editor/project.vala

@@ -52,6 +52,7 @@ namespace Crown
 		public void load(string source_dir, string toolchain_dir)
 		{
 			reset();
+
 			_source_dir    = File.new_for_path(source_dir);
 			_toolchain_dir = File.new_for_path(toolchain_dir);
 			_data_dir      = File.new_for_path(_source_dir.get_path() + "_" + _platform);
@@ -221,6 +222,12 @@ end
 			return _platform;
 		}
 
+		public bool path_is_within_dir(string path, string dir)
+		{
+			GLib.File file = GLib.File.new_for_path(path);
+			return file.has_prefix(_source_dir);
+		}
+
 		public void dump_test_level(Database db)
 		{
 			// Save test level to file