cyberpresidentvanellope/Aurora.3
1
0
Fork 0
mirror of https://github.com/Aurorastation/Aurora.3.git synced 2026-08-23 04:51:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Revert "Apostrophe Bugfix: Plastic Variables (#6547)" (#6549)

Browse Source 
Reverts #6547

This introduces an HTML-injection attack. You can inject arbitrary HTML code into character names and have it be executed upon examining someone.
This commit is contained in:
Erki
2019-06-09 17:26:29 +03:00
committed by GitHub
parent f83f5ba31a
commit fabd8c4d44
2 changed files with 0 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/admin/view_variables/topic.dm
-1
View File
@@ -16,7 +16,6 @@
return
var/new_name = sanitize(input(usr,"What would you like to name this mob?","Input a name",M.real_name) as text|null, MAX_NAME_LEN)
new_name = html_decode(new_name)
if( !new_name || !M ) return
message_admins("Admin [key_name_admin(usr)] renamed [key_name_admin(M)] to [new_name].")