From 2118078422ec8a203b442d94b6ac1f6a2c671fba Mon Sep 17 00:00:00 2001 From: SoundScopes Date: Sun, 4 Sep 2016 18:45:00 +0100 Subject: [PATCH] Fixes a slight exploit from #848 (#863) Fixes an href hack/unintended access to the paper seen by a camera. --- code/game/machinery/camera/camera.dm | 25 +++++++--------------- code/modules/mob/living/silicon/ai/ai.dm | 27 +++++++++++++++++++++++- 2 files changed, 34 insertions(+), 18 deletions(-) diff --git a/code/game/machinery/camera/camera.dm b/code/game/machinery/camera/camera.dm index fddccf77dbb..fb2567da070 100644 --- a/code/game/machinery/camera/camera.dm +++ b/code/game/machinery/camera/camera.dm @@ -157,6 +157,7 @@ // OTHER else if (can_use() && (istype(W, /obj/item/weapon/paper) || istype(W, /obj/item/device/pda)) && isliving(user)) + var/info = null var/mob/living/U = user var/obj/item/weapon/paper/X = null var/obj/item/device/pda/P = null @@ -165,22 +166,26 @@ if(istype(W, /obj/item/weapon/paper)) X = W itemname = X.name + info = X.info else P = W itemname = P.name + info = P.notehtml U << "You hold \a [itemname] up to the camera ..." for(var/mob/living/silicon/ai/O in living_mob_list) + var/entry = O.addCameraRecord(itemname,info) if(!O.client) continue if(U.name == "Unknown") - O << "[U] holds \a [itemname] up to one of your cameras ...view message" + O << "[U] holds \a [itemname] up to one of your cameras ...view message" else - O << "[U] holds \a [itemname] up to one of your cameras ...view message" + O << "[U] holds \a [itemname] up to one of your cameras ...view message" for(var/mob/O in player_list) if (istype(O.machine, /obj/machinery/computer/security)) var/obj/machinery/computer/security/S = O.machine if (S.current == src) - O << "[U] holds \a [itemname] up to one of the cameras ...view message" + O << "[U] holds \a [itemname] up to one of the cameras ..." + O << browse(text("[][]", itemname, info), text("window=[]", itemname)) //Force people watching to open the page so they can't see it again else if (istype(W, /obj/item/weapon/camera_bug)) if (!src.can_use()) @@ -462,17 +467,3 @@ update_icon() update_coverage() -/obj/machinery/camera/Topic(href, href_list) - ..() - if (href_list["readcapturedpaper"]) //Yep stolen from admin faxes - var/obj/item/fax = locate(href_list["readcapturedpaper"]) - if(!fax) - usr << "" - if (istype(fax, /obj/item/weapon/paper)) - var/obj/item/weapon/paper/P = fax - P.show_content(usr,1) - else if (istype(fax, /obj/item/weapon/photo)) - var/obj/item/weapon/photo/H = fax - H.show(usr) - return - return diff --git a/code/modules/mob/living/silicon/ai/ai.dm b/code/modules/mob/living/silicon/ai/ai.dm index e2aee0bd913..abd6c4b735e 100644 --- a/code/modules/mob/living/silicon/ai/ai.dm +++ b/code/modules/mob/living/silicon/ai/ai.dm @@ -80,7 +80,7 @@ var/list/ai_verbs_default = list( var/bombing_station = 0 // Set to 1 if station nuke auto-destruct is activated var/override_CPUStorage = 0 // Bonus/Penalty CPU Storage. For use by admins/testers. var/override_CPURate = 0 // Bonus/Penalty CPU generation rate. For use by admins/testers. - + var/list/cameraRecords = list() //For storing what is shown to the cameras /mob/living/silicon/ai/proc/add_ai_verbs() src.verbs |= ai_verbs_default @@ -479,6 +479,15 @@ var/list/ai_verbs_default = list( else src << "\red System error. Cannot locate [html_decode(href_list["trackname"])]." return + if (href_list["readcapturedpaper"]) //Yep stolen from admin faxes + var/entry = text2num(href_list["readcapturedpaper"]) + if(!entry || !cameraRecords.len) return + if(!cameraRecords[entry]) + src << "Unable to locate visual entry." + return + var/info = cameraRecords[entry] + src<< browse(text("[][]", html_encode(info[1]), html_encode(info[2])), text("window=[]", html_encode(info[1]))) + return return @@ -876,5 +885,21 @@ var/list/ai_verbs_default = list( qdel(psupply) psupply = new/obj/machinery/ai_powersupply(src) +/mob/living/silicon/ai/proc/addCameraRecord(var/itemName,var/info) + if(!itemName || !info) + return -1 + + if(!cameraRecords) + cameraRecords = list() + + //Didn't really want to loop here + for(var/i = 1, i <= cameraRecords.len, i++) + if(cameraRecords[i][1] == itemName && cameraRecords[i][2] == info) + return i + + var/s = list(itemName,info) + cameraRecords += list(s) + return cameraRecords.len + #undef AI_CHECK_WIRELESS #undef AI_CHECK_RADIO