From 13ba3d762268d5fdaca3342d31f08dde7ed01cd8 Mon Sep 17 00:00:00 2001 From: SkyratBot <59378654+SkyratBot@users.noreply.github.com> Date: Sat, 24 Jun 2023 15:23:47 +0200 Subject: [PATCH] [MIRROR] [s] Require affirmative input from the admin to run sdql2 verbs [MDB IGNORE] (#22025) * [s] Require affirmative input from the admin to run sdql2 verbs (#76276) Powerful or dangerous admin verbs should have some prompt or forced runtime input to lower the attack surface once somebody finds a href exploit since topics can trigger commands and verbs. * [s] Require affirmative input from the admin to run sdql2 verbs --------- Co-authored-by: Kyle Spier-Swenson --- code/modules/admin/verbs/SDQL2/SDQL_2.dm | 3 +++ 1 file changed, 3 insertions(+) diff --git a/code/modules/admin/verbs/SDQL2/SDQL_2.dm b/code/modules/admin/verbs/SDQL2/SDQL_2.dm index bd94e2ecc87..0702183bfe2 100644 --- a/code/modules/admin/verbs/SDQL2/SDQL_2.dm +++ b/code/modules/admin/verbs/SDQL2/SDQL_2.dm @@ -201,6 +201,9 @@ message_admins(span_danger("ERROR: Non-admin [key_name(usr)] attempted to execute a SDQL query!")) usr.log_message("non-admin attempted to execute a SDQL query!", LOG_ADMIN) return FALSE + var/prompt = tgui_alert(usr, "Run SDQL2 Query?", "SDQL2", list("Yes", "Cancel")) + if (prompt != "Yes") + return var/list/results = world.SDQL2_query(query_text, key_name_admin(usr), "[key_name(usr)]") if(length(results) == 3) for(var/I in 1 to 3)