From dbd239f4ec94d25f77be2600dfc267569703ef9e Mon Sep 17 00:00:00 2001 From: volas Date: Sat, 18 Apr 2015 14:36:49 +0300 Subject: [PATCH 1/2] Corrections dual sanitizing --- code/game/gamemodes/cult/runes.dm | 10 +++++----- code/modules/admin/topic.dm | 2 +- code/modules/admin/verbs/pray.dm | 6 ++---- code/modules/admin/verbs/randomverbs.dm | 2 +- 4 files changed, 9 insertions(+), 11 deletions(-) diff --git a/code/game/gamemodes/cult/runes.dm b/code/game/gamemodes/cult/runes.dm index 6f64faca59b..10d7fb7e4ac 100644 --- a/code/game/gamemodes/cult/runes.dm +++ b/code/game/gamemodes/cult/runes.dm @@ -574,22 +574,22 @@ var/list/sacrificed = list() // returns 0 if the rune is not used. returns 1 if the rune is used. communicate() . = 1 // Default output is 1. If the rune is deleted it will return 1 - var/input = sanitize(input(usr, "Please choose a message to tell to the other acolytes.", "Voice of Blood", "")) + var/input = input(usr, "Please choose a message to tell to the other acolytes.", "Voice of Blood", "")//sanitize() below, say() and whisper() have their own if(!input) if (istype(src)) fizzle() return 0 else return 0 - if(istype(src,/obj/effect/rune)) - usr.say("O bidai nabora se[pick("'","`")]sma!") - else - usr.whisper("O bidai nabora se[pick("'","`")]sma!") if(istype(src,/obj/effect/rune)) + usr.say("O bidai nabora se[pick("'","`")]sma!") usr.say("[input]") else + usr.whisper("O bidai nabora se[pick("'","`")]sma!") usr.whisper("[input]") + + input = sanitize(input) for(var/datum/mind/H in cult.current_antagonists) if (H.current) H.current << "\red \b [input]" diff --git a/code/modules/admin/topic.dm b/code/modules/admin/topic.dm index 43ea750f7a5..8f943ccb6ca 100644 --- a/code/modules/admin/topic.dm +++ b/code/modules/admin/topic.dm @@ -1323,7 +1323,7 @@ return if(L.can_centcom_reply()) - var/input = input(src.owner, "Please enter a message to reply to [key_name(L)] via their headset.","Outgoing message from Centcomm", "") + var/input = sanitize(input(src.owner, "Please enter a message to reply to [key_name(L)] via their headset.","Outgoing message from Centcomm", "")) if(!input) return src.owner << "You sent [input] to [L] via a secure channel." diff --git a/code/modules/admin/verbs/pray.dm b/code/modules/admin/verbs/pray.dm index 8b2d0700039..d987c52260b 100644 --- a/code/modules/admin/verbs/pray.dm +++ b/code/modules/admin/verbs/pray.dm @@ -28,15 +28,13 @@ feedback_add_details("admin_verb","PR") //If you are copy-pasting this, ensure the 2nd parameter is unique to the new proc! //log_admin("HELP: [key_name(src)]: [msg]") -/proc/Centcomm_announce(var/text , var/mob/Sender , var/iamessage) - var/msg = sanitize(text) +/proc/Centcomm_announce(var/msg, var/mob/Sender, var/iamessage) msg = "\blue CENTCOMM[iamessage ? " IA" : ""]:[key_name(Sender, 1)] (PP) (VV) (SM) (JMP) (CA) (BSA) (RPLY): [msg]" for(var/client/C in admins) if(R_ADMIN & C.holder.rights) C << msg -/proc/Syndicate_announce(var/text , var/mob/Sender) - var/msg = sanitize(text) +/proc/Syndicate_announce(var/msg, var/mob/Sender) msg = "\blue ILLEGAL:[key_name(Sender, 1)] (PP) (VV) (SM) (JMP) (CA) (BSA) (RPLY): [msg]" for(var/client/C in admins) if(R_ADMIN & C.holder.rights) diff --git a/code/modules/admin/verbs/randomverbs.dm b/code/modules/admin/verbs/randomverbs.dm index 64e44e17e90..f77bc097858 100644 --- a/code/modules/admin/verbs/randomverbs.dm +++ b/code/modules/admin/verbs/randomverbs.dm @@ -527,7 +527,7 @@ Traitors and the like can also be revived with the previous role mostly intact. switch(alert("Should this be announced to the general population?",,"Yes","No")) if("Yes") - command_announcement.Announce(input, customname, new_sound = 'sound/AI/commandreport.ogg'); + command_announcement.Announce(input, customname, new_sound = 'sound/AI/commandreport.ogg', msg_sanitized = 1); if("No") world << "\red New NanoTrasen Update available at all communication consoles." world << sound('sound/AI/commandreport.ogg') From 7dedbc6d788b22a67c9e19ceebaf00437e80ec0d Mon Sep 17 00:00:00 2001 From: volas Date: Sun, 19 Apr 2015 00:43:44 +0300 Subject: [PATCH 2/2] Alternative copytext, safe for html entities --- code/__HELPERS/text.dm | 8 ++++++-- code/modules/mob/mob.dm | 2 +- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/code/__HELPERS/text.dm b/code/__HELPERS/text.dm index 9ebc3512dde..5c0324a3e92 100644 --- a/code/__HELPERS/text.dm +++ b/code/__HELPERS/text.dm @@ -274,7 +274,11 @@ proc/TextPreview(var/string,var/len=40) else return string else - return "[copytext(string, 1, 37)]..." + return "[copytext_preserve_html(string, 1, 37)]..." + +//alternative copytext() for encoded text, doesn't break html entities (" and other) +/proc/copytext_preserve_html(var/text, var/first, var/last) + return html_encode(copytext(html_decode(text), first, last)) //For generating neat chat tag-images //The icon var could be local in the proc, but it's a waste of resources @@ -283,4 +287,4 @@ proc/TextPreview(var/string,var/len=40) /proc/create_text_tag(var/tagname, var/tagdesc = tagname, var/client/C = null) if(C && (C.prefs.toggles & CHAT_NOICONS)) return tagdesc - return "[tagdesc]" + return "[tagdesc]" \ No newline at end of file diff --git a/code/modules/mob/mob.dm b/code/modules/mob/mob.dm index 0af4b0a2352..69f5931fc0b 100644 --- a/code/modules/mob/mob.dm +++ b/code/modules/mob/mob.dm @@ -304,7 +304,7 @@ if(lentext(msg) <= 40) return "\blue [msg]" else - return "\blue [copytext(msg, 1, 37)]... More..." + return "\blue [copytext_preserve_html(msg, 1, 37)]... More..." /* /mob/verb/help()