cyberpresidentvanellope/Bubberstation
1
0
Fork 0
mirror of https://github.com/Bubberstation/Bubberstation.git synced 2026-08-22 20:48:56 +01:00
Code Issues Packages Projects Releases Wiki Activity

[s] webedit security patch to locate() wrapper (#66264) (#13307)

Browse Source 
Co-authored-by: silicons <2003111+silicons@users.noreply.github.com>
This commit is contained in:
SkyratBot
2022-05-04 10:30:23 +01:00
committed by GitHub
co-authored by silicons
parent ad28548438
commit 440a471c0c
2 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/admin/verbs/SDQL2/SDQL_2.dm
+7 -3
View File
@@ -1023,10 +1023,14 @@ GLOBAL_DATUM_INIT(sdql2_vv_statobj, /obj/effect/statclick/sdql2_vv_all, new(null
if(lowertext(copytext(expression[start + 1], 1, 3)) != "0x") //3 == length("0x") + 1
to_chat(usr, span_danger("Invalid pointer syntax: [expression[start + 1]]"), confidential = TRUE)
return null
v = locate("\[[expression[start + 1]]]")
if(!v)
to_chat(usr, span_danger("Invalid pointer: [expression[start + 1]]"), confidential = TRUE)
var/datum/located = locate("\[[expression[start + 1]]]")
if(!istype(located))
to_chat(usr, span_danger("Invalid pointer: [expression[start + 1]] - null or not datum"), confidential = TRUE)
return null
if(!located.can_vv_mark())
to_chat(usr, span_danger("Pointer [expression[start+1]] cannot be marked"), confidential = TRUE)
return null
v = located
start++
long = start < expression.len
else if(expression[start] == "(" && long)
code/modules/admin/verbs/SDQL2/SDQL_2_wrappers.dm
+4 -1
View File
@@ -62,7 +62,10 @@
/proc/_locate(X, Y, Z)
if (isnull(Y)) // Assuming that it's only a single-argument call.
return locate(X)
// direct ref locate
var/datum/D = locate(X)
// &&'s to last value
return istype(D) && D.can_vv_mark() && D
return locate(X, Y, Z)