From 28e7e68f4fc17eed3d2dc93e1d635865f0bb6714 Mon Sep 17 00:00:00 2001 From: Kyle Spier-Swenson Date: Tue, 17 Dec 2024 15:55:52 -0800 Subject: [PATCH] Trainers can now verify admins above their weight class (#88360) bounty pr ## About The Pull Request Lets anyone with permissions verify any admin past 2fa, not just ones lower than them on the ~totem~ permission pole. ## Why It's Good For The Game ![image](https://github.com/user-attachments/assets/22b70b52-ffca-4b10-a8c5-f7a3cae2f452) (also fixes an exploit where you could action protected admins who were deadmined because `D` wouldn't be set by that point.) --- code/modules/admin/permissionedit.dm | 42 ++++++++++++++-------------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/code/modules/admin/permissionedit.dm b/code/modules/admin/permissionedit.dm index 73987622202..6bd97dcaa20 100644 --- a/code/modules/admin/permissionedit.dm +++ b/code/modules/admin/permissionedit.dm @@ -140,9 +140,14 @@ ADMIN_VERB(edit_admin_permissions, R_PERMISSIONS, "Permissions Panel", "Edit adm permissions_assets.send(usr.client) var/admin_key = href_list["key"] var/admin_ckey = ckey(admin_key) - var/datum/admins/D = GLOB.admin_datums[admin_ckey] - var/use_db + var/task = href_list["editrights"] + var/datum/admins/target_admin_datum = GLOB.admin_datums[admin_ckey] + if(!target_admin_datum) + target_admin_datum = GLOB.deadmins[admin_ckey] + if (!target_admin_datum && task != "add") + return + var/use_db var/skip var/legacy_only if(task == "activate" || task == "deactivate" || task == "sync" || task == "verify") @@ -152,7 +157,7 @@ ADMIN_VERB(edit_admin_permissions, R_PERMISSIONS, "Permissions Panel", "Edit adm to_chat(usr, "Editing the rank of this admin is blocked by server configuration.", confidential = TRUE) return if(!CONFIG_GET(flag/admin_legacy_system) && CONFIG_GET(flag/protect_legacy_ranks) && task == "permissions") - if((D.ranks & GLOB.protected_ranks).len > 0) + if((target_admin_datum.ranks & GLOB.protected_ranks).len > 0) to_chat(usr, "Editing the flags of this rank is blocked by server configuration.", confidential = TRUE) return if(CONFIG_GET(flag/load_legacy_ranks_only) && (task == "add" || task == "rank" || task == "permissions")) @@ -173,16 +178,11 @@ ADMIN_VERB(edit_admin_permissions, R_PERMISSIONS, "Permissions Panel", "Edit adm use_db = FALSE if(QDELETED(usr)) return - if(task != "add") - D = GLOB.admin_datums[admin_ckey] - if(!D) - D = GLOB.deadmins[admin_ckey] - if(!D) - return - if((task != "sync") && !check_if_greater_rights_than_holder(D)) - message_admins("[key_name_admin(usr)] attempted to change the rank of [admin_key] without sufficient rights.") - log_admin("[key_name(usr)] attempted to change the rank of [admin_key] without sufficient rights.") - return + + if(target_admin_datum && (task != "sync" && task != "verify") && !check_if_greater_rights_than_holder(target_admin_datum)) + message_admins("[key_name_admin(usr)] attempted to change the rank of [admin_key] without sufficient rights.") + log_admin("[key_name(usr)] attempted to change the rank of [admin_key] without sufficient rights.") + return switch(task) if("add") admin_ckey = add_admin(admin_ckey, admin_key, use_db) @@ -194,24 +194,24 @@ ADMIN_VERB(edit_admin_permissions, R_PERMISSIONS, "Permissions Panel", "Edit adm change_admin_rank(admin_ckey, admin_key, use_db, null, legacy_only) if("remove") - remove_admin(admin_ckey, admin_key, use_db, D) + remove_admin(admin_ckey, admin_key, use_db, target_admin_datum) if("rank") - change_admin_rank(admin_ckey, admin_key, use_db, D, legacy_only) + change_admin_rank(admin_ckey, admin_key, use_db, target_admin_datum, legacy_only) if("permissions") - change_admin_flags(admin_ckey, admin_key, D) + change_admin_flags(admin_ckey, admin_key, target_admin_datum) if("activate") - force_readmin(admin_key, D) + force_readmin(admin_key, target_admin_datum) if("deactivate") - force_deadmin(admin_key, D) + force_deadmin(admin_key, target_admin_datum) if("sync") - sync_lastadminrank(admin_ckey, admin_key, D) + sync_lastadminrank(admin_ckey, admin_key, target_admin_datum) if("verify") var/msg = "has authenticated [admin_ckey]" message_admins("[key_name_admin(usr)] [msg]") log_admin("[key_name(usr)] [msg]") - D.bypass_2fa = TRUE - D.associate(GLOB.directory[admin_ckey]) + target_admin_datum.bypass_2fa = TRUE + target_admin_datum.associate(GLOB.directory[admin_ckey]) edit_admin_permissions() /datum/admins/proc/add_admin(admin_ckey, admin_key, use_db)