cyberpresidentvanellope/Bubberstation
1
0
Fork 0
mirror of https://github.com/Bubberstation/Bubberstation.git synced 2026-08-23 05:00:55 +01:00
Code Issues Packages Projects Releases Wiki Activity

[s] Adds a security token to all admin hrefs (#29839)

Browse Source 
There's a certain issue of people spoofing real byond links to admins. Now all links should come with a generated key that is validated when the Topic is run.

Added DEBUG_ADMIN_HREFS to debug this system while we test it (Allows hrefs without tokens and complains about it in the logs)

Just add [HrefToken()] as a parameter to all admin hrefs. Anything that ends up running through VV or Holder will be verified
This commit is contained in:
Jordan Brown
2017-09-09 12:15:53 +10:00
committed by oranges
parent 151d8f3054
commit 84b1e3d71e
32 changed files with 455 additions and 407 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/admin/create_object.dm
+2 -2
View File
@@ -6,7 +6,7 @@
create_object_html = file2text('html/create_object.html')
create_object_html = replacetext(create_object_html, "null /* object types */", "\"[objectjs]\"")
user << browse(replacetext(create_object_html, "/* ref src */", "\ref[src]"), "window=create_object;size=425x475")
user << browse(replacetext(create_object_html, "/* ref src */", "\ref[src];[HrefToken()]"), "window=create_object;size=425x475")
/datum/admins/proc/quick_create_object(mob/user)
var/static/list/create_object_forms = list(
@@ -23,4 +23,4 @@
html_form = replacetext(html_form, "null /* object types */", "\"[objectjs]\"")
create_object_forms[path] = html_form
user << browse(replacetext(html_form, "/* ref src */", "\ref[src]"), "window=qco[path];size=425x475")
user << browse(replacetext(html_form, "/* ref src */", "\ref[src];[HrefToken()]"), "window=qco[path];size=425x475")