The [autoexec] sections join or overwrite each other (depending on the autoexec_section setting), in order, starting the with primary conf to the local conf and finally any number of -conf custom.conf specified on the CLI.

For example, given three local confs as follows:

• dosbox.conf:

  [autoexec]
  @echo 1

• 3.conf:

  [autoexec]
  @echo 3

• 5.conf:

  [autoexec]
  @echo 5

The command: dosbox -conf 3.conf -conf 5.conf produces:

1
3
5

When it comes to -c commands, they can be thought of as line-by-line [autoexec] sections as well.

For several releases, the CLI commands have come first in the above order, however I think it makes sense to treat them in the same order, with the first -c command coming after (or joining) into the flow of conf's, starting after the local dosbox.conf.

So for example:

dosbox -c "@echo 2" -conf 3.conf -c "@echo 4" -conf 5.conf

Should produce:

1
2
3
4
5

The secure flag is meant to prevent commands inside the interactive DOS environment from changing the mounts (and I suppose, doing harmful things.. like remounting the host's C:\WINDOWS\SYSTEM32\ and deleting everything in there).

I think as soon as we're done processing all arguments on the CLI, then -secure should go into effect.

But you must enable securemode right at the start, otherwise one could still pass in a mount command on the CLI, no?

Actually, answering my own question: if it's meant only to prevent users from using the mount command interactively, then yeah, it should be enabled as the last step before giving the usert prompt access.

Regarding order of execution, what @kcgen described is pretty much the only sensible way.

This -securemode switch dos not look like a reliable way to protect against malicious user - if he somehow manages to send CTRl+C to the emulator before we execute Z:\CONFIG.COM -securemode... the only way that prevents such an exploit from working is that we do not have a proper CTRL+C support :)
OK, I'll move the secure mode enabling before the [autoexec] content, additionally I'm going to make the -securemode switch to block any keyboard input until we execute Z:\CONFIG.COM -securemode - this should improve the security.

Regarding the commands and [autoexec] - OK, makes sense, I'll implement as @kcgen suggests.

@kcgen Configuration is not really that relevant here - the most important are the command line parameters. Try different combinations of:

• dosbox -c command1 -c command2
• dosbox -securemode

with:

• dosbox directory
• dosbox command
• dosbox file.img
• dosbox file.iso

for example, dosbox -c command1 -securemode file.iso /directory/. When you see the command prompt, type more Z:\AUTOEXEC.BAT to check content of the generated AUTOEXEC.BAT.

@kcgen Configuration is not really that relevant here - the most important are the command line parameters. Try different combinations of:

* `dosbox -c command1 -c command2`

* `dosbox -securemode`

with:

* `dosbox directory`

* `dosbox command`

* `dosbox file.img`

* `dosbox file.iso`

for example, dosbox -c command1 -securemode file.iso /directory/. When you see the command prompt, type more Z:\AUTOEXEC.BAT to check content of the generated AUTOEXEC.BAT.

Wow @FeralChild64 .. this is brilliant! It "just works" :-), and I cannot confuse it.

Will restart the CI tasks and will merge once the remainder are confirmed passing.

CI is 📗 - time to merge 🚀