mirror of
https://github.com/Bubberstation/Bubberstation.git
synced 2026-08-30 16:47:13 +01:00
Ensures external libraries can't be called by callbacks (#71346)
## About The Pull Request It is possible to create a callback whose `object` (the datum it tries to call) is a path to an external library. Needless to say, it's probably a bad idea to allow admins to call arbitrary external libraries. Var-edited callbacks won't be able to reach the point where the library is executed, but only because `WrapAdminProcCall` runtimes when trying to call `CanProcCall` on a string, but if there is some way to call a function that creates a non-varedited callback with an external library as its object, this PR prevents that. ## Why It's Good For The Game See above. ## Changelog 🆑 admin: Admins are unable to invoke functions from external libraries using callbacks. /🆑
This commit is contained in:
@@ -109,6 +109,12 @@
|
||||
if (!object)
|
||||
return
|
||||
|
||||
#if DM_VERSION <= 514
|
||||
if(istext(object) && object != GLOBAL_PROC)
|
||||
to_chat(usr, "[object] may be an external library. Calling external libraries is disallowed.", confidential = TRUE)
|
||||
return
|
||||
#endif
|
||||
|
||||
var/list/calling_arguments = arguments
|
||||
if (length(args))
|
||||
if (length(arguments))
|
||||
@@ -146,6 +152,12 @@
|
||||
if (!object)
|
||||
return
|
||||
|
||||
#if DM_VERSION <= 514
|
||||
if(istext(object) && object != GLOBAL_PROC)
|
||||
to_chat(usr, "[object] may be an external library. Calling external libraries is disallowed.", confidential = TRUE)
|
||||
return
|
||||
#endif
|
||||
|
||||
var/list/calling_arguments = arguments
|
||||
if (length(args))
|
||||
if (length(arguments))
|
||||
|
||||
Reference in New Issue
Block a user