cyberpresidentvanellope/Aurora.3
1
0
Fork 0
mirror of https://github.com/Aurorastation/Aurora.3.git synced 2026-08-31 09:00:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fixes a slight exploit from #848 (#863)

Browse Source 
Fixes an href hack/unintended access to the paper seen by a camera.
This commit is contained in:
SoundScopes
2016-09-04 19:45:00 +02:00
committed by skull132
parent 3c693545a1
commit 2118078422
2 changed files with 34 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/game/machinery/camera/camera.dm
+8 -17
View File
@@ -157,6 +157,7 @@
// OTHER
else if (can_use() && (istype(W, /obj/item/weapon/paper) || istype(W, /obj/item/device/pda)) && isliving(user))
var/info = null
var/mob/living/U = user
var/obj/item/weapon/paper/X = null
var/obj/item/device/pda/P = null
@@ -165,22 +166,26 @@
if(istype(W, /obj/item/weapon/paper))
X = W
itemname = X.name
info = X.info
else
P = W
itemname = P.name
info = P.notehtml
U << "You hold \a [itemname] up to the camera ..."
for(var/mob/living/silicon/ai/O in living_mob_list)
var/entry = O.addCameraRecord(itemname,info)
if(!O.client) continue
if(U.name == "Unknown")
O << "<b>[U]</b> holds \a [itemname] up to one of your cameras ...<a href='?src=\ref[src];readcapturedpaper=\ref[W]'>view message</a>"
O << "<b>[U]</b> holds \a [itemname] up to one of your cameras ...<a href='?src=\ref[O];readcapturedpaper=\ref[entry]'>view message</a>"
else
O << "<b><a href='byond://?src=\ref[O];track2=\ref[O];track=\ref[U];trackname=[html_encode(U.name)]'>[U]</a></b> holds \a [itemname] up to one of your cameras ...<a href='?src=\ref[src];readcapturedpaper=\ref[W]'>view message</a>"
O << "<b><a href='byond://?src=\ref[O];track2=\ref[O];track=\ref[U];trackname=[html_encode(U.name)]'>[U]</a></b> holds \a [itemname] up to one of your cameras ...<a href='?src=\ref[O];readcapturedpaper=[entry]'>view message</a>"
for(var/mob/O in player_list)
if (istype(O.machine, /obj/machinery/computer/security))
var/obj/machinery/computer/security/S = O.machine
if (S.current == src)
O << "[U] holds \a [itemname] up to one of the cameras ...<a href='?src=\ref[src];readcapturedpaper=\ref[W]'>view message</a>"
O << "[U] holds \a [itemname] up to one of the cameras ..."
O << browse(text("<HTML><HEAD><TITLE>[]</TITLE></HEAD><BODY><TT>[]</TT></BODY></HTML>", itemname, info), text("window=[]", itemname)) //Force people watching to open the page so they can't see it again
else if (istype(W, /obj/item/weapon/camera_bug))
if (!src.can_use())
@@ -462,17 +467,3 @@
update_icon()
update_coverage()
/obj/machinery/camera/Topic(href, href_list)
..()
if (href_list["readcapturedpaper"]) //Yep stolen from admin faxes
var/obj/item/fax = locate(href_list["readcapturedpaper"])
if(!fax)
usr << ""
if (istype(fax, /obj/item/weapon/paper))
var/obj/item/weapon/paper/P = fax
P.show_content(usr,1)
else if (istype(fax, /obj/item/weapon/photo))
var/obj/item/weapon/photo/H = fax
H.show(usr)
return
return
code/modules/mob/living/silicon/ai/ai.dm
+26 -1
View File
@@ -80,7 +80,7 @@ var/list/ai_verbs_default = list(
var/bombing_station = 0 // Set to 1 if station nuke auto-destruct is activated
var/override_CPUStorage = 0 // Bonus/Penalty CPU Storage. For use by admins/testers.
var/override_CPURate = 0 // Bonus/Penalty CPU generation rate. For use by admins/testers.
var/list/cameraRecords = list() //For storing what is shown to the cameras
/mob/living/silicon/ai/proc/add_ai_verbs()
src.verbs |= ai_verbs_default
@@ -479,6 +479,15 @@ var/list/ai_verbs_default = list(
else
src << "\red System error. Cannot locate [html_decode(href_list["trackname"])]."
return
if (href_list["readcapturedpaper"]) //Yep stolen from admin faxes
var/entry = text2num(href_list["readcapturedpaper"])
if(!entry || !cameraRecords.len) return
if(!cameraRecords[entry])
src << "<span class='notice'>Unable to locate visual entry.</span>"
return
var/info = cameraRecords[entry]
src<< browse(text("<HTML><HEAD><TITLE>[]</TITLE></HEAD><BODY><TT>[]</TT></BODY></HTML>", html_encode(info[1]), html_encode(info[2])), text("window=[]", html_encode(info[1])))
return
return
@@ -876,5 +885,21 @@ var/list/ai_verbs_default = list(
qdel(psupply)
psupply = new/obj/machinery/ai_powersupply(src)
/mob/living/silicon/ai/proc/addCameraRecord(var/itemName,var/info)
if(!itemName || !info)
return -1
if(!cameraRecords)
cameraRecords = list()
//Didn't really want to loop here
for(var/i = 1, i <= cameraRecords.len, i++)
if(cameraRecords[i][1] == itemName && cameraRecords[i][2] == info)
return i
var/s = list(itemName,info)
cameraRecords += list(s)
return cameraRecords.len
#undef AI_CHECK_WIRELESS
#undef AI_CHECK_RADIO