cyberpresidentvanellope/Bubberstation
1
0
Fork 0
mirror of https://github.com/Bubberstation/Bubberstation.git synced 2026-08-29 08:08:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

[MIRROR] Fixes negative payment in NTpay & Encodes name param sent to admins in fax [MDB IGNORE] (#17729)

Browse Source 
* Fixes negative payment in NTpay & Encodes name param sent to admins in fax (#71491)

## About The Pull Request
NTpay wasn't validating negative input serverside, allowing for negative
payment to users(Negative - Negative = Positive, so it adds money to the
senders account.) Also encodes a parameter that was sent unsanitized to
admins.
## Why It's Good For The Game
## Changelog
🆑
fix: Fixes a NTPay exploit.
/🆑

* Fixes negative payment in NTpay & Encodes name param sent to admins in fax

Co-authored-by: CocaColaTastesGood <47264839+CocaColaTastesGood@users.noreply.github.com>
This commit is contained in:
SkyratBot
2022-11-24 22:13:16 +00:00
committed by GitHub
co-authored by CocaColaTastesGood
parent 861db9f912
commit 9f06f26ee5
3 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/paperwork/fax.dm
+7 -7
View File
@@ -253,7 +253,7 @@
playsound(src, 'sound/machines/eject.ogg', 50, FALSE)
update_appearance()
return TRUE
if("send")
var/obj/item/loaded = loaded_item_ref?.resolve()
if (!loaded)
@@ -264,13 +264,13 @@
loaded_item_ref = null
update_appearance()
return TRUE
if("send_special")
var/obj/item/paper/fax_paper = loaded_item_ref?.resolve()
if(!istype(fax_paper))
to_chat(usr, icon2html(src.icon, usr) + span_warning("Fax cannot send all above paper on this protected network, sorry."))
return
return
fax_paper.request_state = TRUE
fax_paper.loc = null
@@ -278,13 +278,13 @@
playsound(src, 'sound/machines/high_tech_confirm.ogg', 50, vary = FALSE)
history_add("Send", params["name"])
GLOB.requests.fax_request(usr.client, "sent a fax message from [fax_name]/[fax_id] to [params["name"]]", fax_paper)
to_chat(GLOB.admins, span_adminnotice("[icon2html(src.icon, GLOB.admins)]<b><font color=green>FAX REQUEST: </font>[ADMIN_FULLMONTY(usr)]:</b> [span_linkify("sent a fax message from [fax_name]/[fax_id][ADMIN_FLW(src)] to [params["name"]]")] [ADMIN_SHOW_PAPER(fax_paper)]"), confidential = TRUE)
to_chat(GLOB.admins, span_adminnotice("[icon2html(src.icon, GLOB.admins)]<b><font color=green>FAX REQUEST: </font>[ADMIN_FULLMONTY(usr)]:</b> [span_linkify("sent a fax message from [fax_name]/[fax_id][ADMIN_FLW(src)] to [html_encode(params["name"])]")] [ADMIN_SHOW_PAPER(fax_paper)]"), confidential = TRUE)
log_fax(fax_paper, params["id"], params["name"])
loaded_item_ref = null
update_appearance()
if("history_clear")
history_clear()
return TRUE