As a security-conscious user, I don’t allow scripts to execute from any location to which the standard user can write. That’s the principle behind AppLocker. But with current Notepad++ behavior, there’s nothing I can do to prevent NppExec scripts from being saved in (and running from) the user-writable %appdata%\Roaming\Notepad++\Plugins\Config\npes_saved.txt file as long as Notepad++ is installed in the default location of C:\Program Files (x86). That means an attacker can write whatever they want to npes_saved.txt and execute it through Notepad++ all without administrative privileges, making NppExec a potentially useful vector for ransomware at the very least.

To protect against such attacks without having to create extra AppLocker allowances or make changes to folder permissions, I currently have to install the 32-bit Notepad++ in the 64-bit location C:\Program Files, which is not a big deal. But I thought I’d bring it up with you anyway to see what you think. Thanks for all your hard work! I love the program.

Missing %appdata%\Notepad++\plugins\config folder when creating new profile. It appears the plugins expect this folder to already exist and won’t create it when trying to save their settings.

1. Install Notepad++ with default settings.
2. Log on as different user. (or delete %appdata%\Notepad++ folder)
3. Start Notepad++ and it will create the %appdata%\Notepad++ folder with the config files but no sub folders.
4. You can test with Plugins > Converter > Edit Configuration File. Expect to open file (it is created if folder exists), instead get error message to manually create file.

The installer does create this folder and also the themes folder, even if you chose not to start application after install. So it will work ok for only the user that installed it. I also expected the themes to be created in the program files and not appdata.

I’m also seeing the empty %localappdata%\Notepad++ folder being created when starting the application.

Notepad++ v7.5.1 (32-bit)
Build time : Aug 29 2017 - 02:35:41
Path : C:\Program Files (x86)\Notepad++\notepad++.exe
Admin mode : OFF
Local Conf mode : OFF
OS : Windows 10 (64-bit)
Plugins : mimeTools.dll NppConverter.dll NppExport.dll

(OS is actually Windows Server 2016)

AFAIK it can’t be disabled. What’s the problem? Simply don’t do what invokes (desribed earlier) the “ghost quotes” feature…and it is in no way that I can see “spiritual”. Some of the quotes are maybe a bit questionable if Notepad++ is used in an educational environment with young children…is this the concern?

; Translate F12 to Ctrl+`
F12::
Send {Ctrl Down}``{Ctrl Up}
return

I’m not sure what version of notepad++ I had previously installed. If someone can point me to where that might be logged, I can add the information.

I’ve tried a couple of other keys to overwrite, and the problem happens consistently. Here’s the rest of my configuration if that helps:
;
; AutoHotkey Version: 1.x
; Language: English
; Platform: Win9x/NT
; Author: A.N.Other myemail@nowhere.com
;
; Script Function:
; Template script (you can customize this template by editing “ShellNew\Template.ahk” in your Windows folder)
;
+Delete::Send {Delete}

SetTitleMatchMode, 2
#NoEnv ; Recommended for performance and compatibility with future AutoHotkey releases.
SendMode Input ; Recommended for new scripts due to its superior speed and reliability.
SetWorkingDir %A_ScriptDir% ; Ensures a consistent starting directory.

; Redefine only when the active window is a console window
#IfWinActive ahk_class ConsoleWindowClass

; Paste in command window wit Ctrl+v
^V::
; (Edit->Paste)
Send !{Space}ep
return

#IfWinActive

; Hotkey to make window always on top
!^SPACE::
Winset, Alwaysontop, , A
return

; Translate F12 to Ctrl+`
F12::
Send {Ctrl Down}``{Ctrl Up}
return

#IfWinActive WinDbg

; Go To Line with Ctrl+l
$^g::
Send ^l
return

I was using 7.5 and I don’t know if it’s connected but this morning I also got the popup if I wanted to download 7.5.1, I declined.

The best things in life are free.
Notepad++ is free.
So Notepad++ is the best.

I must point out a fatal flaw in this reasoning.
The only thing the first two lines prove is that Notepad++ might be the best (of course we all know it is regardless).

Also, I could get Notepad++ #2 to work but not Notepad++ #1 🤔

screen shot

I was sorry to find that the new Find box (with a find up and a find down button) has reverted to the old style. Is there an option to obtain the new Find box?

David

edit: i forgot the code marker, so the above example reformats the * in the code text.

THIS is the working regex replace example you can try:

test code:
<style type="text/css"></style>
<a href="url">1</a><br>
<a href="url">2</a><br>
<a href="url">3</a><br>
<img="img1"/>

replace:
regex search string: ^<a href(.*?)>(.*?)<(.*?$)
regex replace string: <a id="link$2" href$1>$2<$3

result:
<style type="text/css"></style>
<a id="link1" href="url">1</a><br>
<a id="link2" href="url">2</a><br>
<a id="link3" href="url">3</a><br>
<img="img1"/>

i’ve just tested regex-replace-all on 7.5.1 installer and zip release versions, because i also use this often.
both notepad++ releases work perfectly.

did you recheck your search wildcards (.*?) and $x variables in your replace string for any syntax error ?
maybe … just maybe … they replace the same content back ?

here’s a little working regex replace example you can try:

test code:
<style type=“text/css”></style>
<a href=“url”>1</a><br>
<a href=“url”>2</a><br>
<a href=“url”>3</a><br>
<img=“img1”/>

replace:
regex search string: ^<a href(.?)>(.?)<(.*?$)
regex replace string: <a id=“link$2” href$1>$2<$3

result:
<style type=“text/css”></style>
<a id=“link1” href=“url”>1</a><br>
<a id=“link2” href=“url”>2</a><br>
<a id=“link3” href=“url”>3</a><br>
<img=“img1”/>

“C:\Programs” is fine and has nothing to do with windows, it’s where I put all my portable programs, the name of the folder has nothing to do with this, It could be named “C:\TEMPFOLDER” for all I care and the same thing would happen, this is not “C:\Programs Files” or “C:\Programs Files (x86)”.

Still waiting for @donho to acknowledge what “%APPDATA%\local\notepad++” folder is used for, the one in Roaming is used for settings, Local? it’s empty.

To be more specific than @Meta-Chuh was:

The easiest way to see this (the new “spritual” quote) is to type Notepad++ #3 in an editor window, select that text in-full, and then choose **About Notepad++…" from the ? menu. After you do this, Notepad++ will open a New document window and SLOWLY type something for you.

You could also start Notepad++ running with the following command line to see the same thing (but this is harder to do):
your_path_to_notepad_plus_plus\notepad++.exe -qnNotepad++%20#3

SPOILER ALERT: For those that don’t want to go to the effort to try it, but still want to know what the new and exciting quote is, here it is:

The best things in life are free.
Notepad++ is free.
So Notepad++ is the best.

- Notepad++ #3

Interestingly, this quote is typed by Notepad++ with full ignorance of the selected line-ending type. For example, with Windows CRLF endings selected, the text is typed and Linux LF endings appear: