There's a security flaw for the un-installation of Notepad++ in Windows Register, the string without quotes:
C:\Program Files\Notepad++\uninstall.exe, whereas it should be "C:\Program Files\Notepad++\uninstall.exe".
The reason is, hacker can create a file called c:\program.exe, then Windows could interpret Files\Notepad++\uninstall.exe as the argument, so the system could run c:\program.exe. Ref:
https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities/14464
Fixed by @ozone10:
Fix#10191, fix#6165, close#10369
x64 installer set installation path in "C:/Program Files/Notepad++/" but "don't use %APPDATA%" is enabled.
This commit fix this issue (make it disabled)
Fix#6243
The new installer argument /allowAppDataPluginsLoading add file
allowAppDataPlugins.xml which allows Notepad++ to load plugins
from "%APPDATA%\Notepad++\plugins\"
- Use DWORD instead of string for Minor and major version
- Show only "Uninstall" instead of "Uninstall/Change"
- Write installed size as well which will be shown in "Program and Features"
Closes#2580
Don Ho