Everyone with really old projects will lose their settings but will get a new settings file.

manuskript/load_save/version_0.py

@@ -168,10 +168,13 @@ def loadProject(project):
     else:
         errors.append("outline.xml")
 
-    if "settings.pickle" in files:
-        settings.load(files["settings.pickle"], fromString=True)
+    if "settings.txt" in files:
+        settings.load(files["settings.txt"], fromString=True, protocol=0)
     else:
-        errors.append("settings.pickle")
+        errors.append("settings.txt")
+
+    if "settings.pickle" in files:
+        LOGGER.info("Pickle settings files are no longer supported for security reasons. You can delete it from your data.")
 
     return errors
 

manuskript/settings.py

@@ -2,7 +2,6 @@
 
 import collections
 import json
-import pickle
 
 from PyQt5.QtWidgets import qApp
 
@@ -166,37 +165,21 @@ def save(filename=None, protocol=None):
     #print("Saving:")
     #pp.pprint(allSettings)
 
-    if filename:
-        f = open(filename, "wb")
-        pickle.dump(allSettings, f)
-    else:
-        if protocol == 0:
-            # This looks stupid
-            # But a simple json.dumps with sort_keys will throw a TypeError
-            # because of unorderable types.
-            return json.dumps(json.loads(json.dumps(allSettings)), indent=4, sort_keys=True)
-        else:
-           return pickle.dumps(allSettings)
+    # This looks stupid
+    # But a simple json.dumps with sort_keys will throw a TypeError
+    # because of unorderable types.
+    return json.dumps(json.loads(json.dumps(allSettings)), indent=4, sort_keys=True)
 
 
 def load(string, fromString=False, protocol=None):
-    """Load settings from 'string'. 'string' is the filename of the pickle dump.
-    If fromString=True, string is the data of the pickle dumps."""
+    """fromString=True is deprecated, it shouldn't be used."""
     global allSettings
 
-    if not fromString:
-        try:
-            f = open(string, "rb")
-            allSettings = pickle.load(f)
+    if not string:
+        LOGGER.error("Cannot load settings.")
+        return
 
-        except:
-            LOGGER.error("Cannot load settings, {} does not exist.".format(string))
-            return
-    else:
-        if protocol == 0:
-            allSettings = json.loads(string)
-        else:
-            allSettings = pickle.loads(string)
+    allSettings = json.loads(string)
 
     #pp=pprint.PrettyPrinter(indent=4, compact=False)
     #print("Loading:")