From 56cf16b3ab82aa07d23f81f6ab2bcddcae1fd69a Mon Sep 17 00:00:00 2001 From: Menshin Date: Fri, 14 Nov 2014 13:14:22 +0100 Subject: [PATCH] * Fixed supply comp/order comp href exploit (being able to order any supply pack, even if not hacked/contraband enabled). * HTML tags are now properly stripped from inputted text * Syndicates crates are now orderable. --- code/controllers/supply_shuttle.dm | 19 +++++++++++-------- code/datums/supplypacks.dm | 2 +- 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/code/controllers/supply_shuttle.dm b/code/controllers/supply_shuttle.dm index 65e26c8f0b7..1ec646eccac 100644 --- a/code/controllers/supply_shuttle.dm +++ b/code/controllers/supply_shuttle.dm @@ -479,10 +479,11 @@ var/global/datum/controller/supply_shuttle/supply_shuttle //Find the correct supply_pack datum var/datum/supply_packs/P = supply_shuttle.supply_packs[href_list["doorder"]] - if(!istype(P)) return + if(!istype(P) || P.hidden || P.contraband) //href protection + return var/timeout = world.time + 600 - var/reason = copytext(sanitize(input(usr,"Reason:","Why do you require this item?","") as null|text),1,MAX_MESSAGE_LEN) + var/reason = stripped_input(usr,"Reason:","Why do you require this item?","") if(world.time > timeout) return if(!reason) return @@ -550,7 +551,7 @@ var/global/datum/controller/supply_shuttle/supply_shuttle /obj/machinery/computer/supplycomp/attack_hand(var/mob/user as mob) if(!allowed(user)) - user << " Access Denied." + user << "Access Denied." return if(..()) @@ -579,7 +580,7 @@ var/global/datum/controller/supply_shuttle/supply_shuttle /obj/machinery/computer/supplycomp/attackby(I as obj, user as mob) if(istype(I,/obj/item/weapon/card/emag) && !hacked) - user << " Special supplies unlocked." + user << "Special supplies unlocked." hacked = 1 return else @@ -654,8 +655,9 @@ var/global/datum/controller/supply_shuttle/supply_shuttle temp += "Request from: [get_supply_group_name(cat)]

" for(var/supply_name in supply_shuttle.supply_packs ) var/datum/supply_packs/N = supply_shuttle.supply_packs[supply_name] - if((N.hidden && !hacked) || (N.contraband && !can_order_contraband) || N.group != cat) continue //Have to send the type instead of a reference to - temp += "[supply_name] Cost: [N.cost]
" //the obj because it would get caught by the garbage + if((N.hidden && !hacked) || (N.contraband && !can_order_contraband) || N.group != cat) //Have to send the type instead of a reference to + continue //the obj because it would get caught by the garbage + temp += "[supply_name] Cost: [N.cost]
" /*temp = "Supply points: [supply_shuttle.points]

Request what?

" @@ -673,10 +675,11 @@ var/global/datum/controller/supply_shuttle/supply_shuttle //Find the correct supply_pack datum var/datum/supply_packs/P = supply_shuttle.supply_packs[href_list["doorder"]] - if(!istype(P)) return + if(!istype(P) || (P.hidden && !hacked) || (P.contraband && !can_order_contraband)) //href exploit protection + return var/timeout = world.time + 600 - var/reason = copytext(sanitize(input(usr,"Reason:","Why do you require this item?","") as null|text),1,MAX_MESSAGE_LEN) + var/reason = stripped_input(usr,"Reason:","Why do you require this item?","") if(world.time > timeout) return // if(!reason) return diff --git a/code/datums/supplypacks.dm b/code/datums/supplypacks.dm index 13fb01776d7..830b8402715 100644 --- a/code/datums/supplypacks.dm +++ b/code/datums/supplypacks.dm @@ -154,7 +154,7 @@ var/list/all_supply_groups = list(supply_emergency,supply_security,supply_engine hidden = 1 /datum/supply_packs/emergency/syndicate - name = "#ERROR_NULL_ENTRY" + name = "ERROR_NULL_ENTRY" contains = list(/obj/item/weapon/storage/box/syndicate) cost = 140 containertype = /obj/structure/closet/crate