cyberpresidentvanellope/Bubberstation
1
0
Fork 0
mirror of https://github.com/Bubberstation/Bubberstation.git synced 2026-08-30 16:47:13 +01:00
Code Issues Packages Projects Releases Wiki Activity

Trainers can now verify admins above their weight class (#88360)

Browse Source 
bounty pr


## About The Pull Request

Lets anyone with permissions verify any admin past 2fa, not just ones
lower than them on the ~totem~ permission pole.

## Why It's Good For The Game


![image](https://github.com/user-attachments/assets/22b70b52-ffca-4b10-a8c5-f7a3cae2f452)

(also fixes an exploit where you could action protected admins who were
deadmined because `D` wouldn't be set by that point.)
This commit is contained in:
Kyle Spier-Swenson
2024-12-18 00:55:52 +01:00
committed by GitHub
parent 4b77c6f7c0
commit 28e7e68f4f
1 changed files with 21 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/admin/permissionedit.dm
+21 -21
View File
@@ -140,9 +140,14 @@ ADMIN_VERB(edit_admin_permissions, R_PERMISSIONS, "Permissions Panel", "Edit adm
permissions_assets.send(usr.client)
var/admin_key = href_list["key"]
var/admin_ckey = ckey(admin_key)
var/datum/admins/D = GLOB.admin_datums[admin_ckey]
var/use_db
var/task = href_list["editrights"]
var/datum/admins/target_admin_datum = GLOB.admin_datums[admin_ckey]
if(!target_admin_datum)
target_admin_datum = GLOB.deadmins[admin_ckey]
if (!target_admin_datum && task != "add")
return
var/use_db
var/skip
var/legacy_only
if(task == "activate" || task == "deactivate" || task == "sync" || task == "verify")
@@ -152,7 +157,7 @@ ADMIN_VERB(edit_admin_permissions, R_PERMISSIONS, "Permissions Panel", "Edit adm
to_chat(usr, "<span class='admin prefix'>Editing the rank of this admin is blocked by server configuration.</span>", confidential = TRUE)
return
if(!CONFIG_GET(flag/admin_legacy_system) && CONFIG_GET(flag/protect_legacy_ranks) && task == "permissions")
if((D.ranks & GLOB.protected_ranks).len > 0)
if((target_admin_datum.ranks & GLOB.protected_ranks).len > 0)
to_chat(usr, "<span class='admin prefix'>Editing the flags of this rank is blocked by server configuration.</span>", confidential = TRUE)
return
if(CONFIG_GET(flag/load_legacy_ranks_only) && (task == "add" || task == "rank" || task == "permissions"))
@@ -173,16 +178,11 @@ ADMIN_VERB(edit_admin_permissions, R_PERMISSIONS, "Permissions Panel", "Edit adm
use_db = FALSE
if(QDELETED(usr))
return
if(task != "add")
D = GLOB.admin_datums[admin_ckey]
if(!D)
D = GLOB.deadmins[admin_ckey]
if(!D)
return
if((task != "sync") && !check_if_greater_rights_than_holder(D))
message_admins("[key_name_admin(usr)] attempted to change the rank of [admin_key] without sufficient rights.")
log_admin("[key_name(usr)] attempted to change the rank of [admin_key] without sufficient rights.")
return
if(target_admin_datum && (task != "sync" && task != "verify") && !check_if_greater_rights_than_holder(target_admin_datum))
message_admins("[key_name_admin(usr)] attempted to change the rank of [admin_key] without sufficient rights.")
log_admin("[key_name(usr)] attempted to change the rank of [admin_key] without sufficient rights.")
return
switch(task)
if("add")
admin_ckey = add_admin(admin_ckey, admin_key, use_db)
@@ -194,24 +194,24 @@ ADMIN_VERB(edit_admin_permissions, R_PERMISSIONS, "Permissions Panel", "Edit adm
change_admin_rank(admin_ckey, admin_key, use_db, null, legacy_only)
if("remove")
remove_admin(admin_ckey, admin_key, use_db, D)
remove_admin(admin_ckey, admin_key, use_db, target_admin_datum)
if("rank")
change_admin_rank(admin_ckey, admin_key, use_db, D, legacy_only)
change_admin_rank(admin_ckey, admin_key, use_db, target_admin_datum, legacy_only)
if("permissions")
change_admin_flags(admin_ckey, admin_key, D)
change_admin_flags(admin_ckey, admin_key, target_admin_datum)
if("activate")
force_readmin(admin_key, D)
force_readmin(admin_key, target_admin_datum)
if("deactivate")
force_deadmin(admin_key, D)
force_deadmin(admin_key, target_admin_datum)
if("sync")
sync_lastadminrank(admin_ckey, admin_key, D)
sync_lastadminrank(admin_ckey, admin_key, target_admin_datum)
if("verify")
var/msg = "has authenticated [admin_ckey]"
message_admins("[key_name_admin(usr)] [msg]")
log_admin("[key_name(usr)] [msg]")
D.bypass_2fa = TRUE
D.associate(GLOB.directory[admin_ckey])
target_admin_datum.bypass_2fa = TRUE
target_admin_datum.associate(GLOB.directory[admin_ckey])
edit_admin_permissions()
/datum/admins/proc/add_admin(admin_ckey, admin_key, use_db)