cyberpresidentvanellope/Bubberstation
1
0
Fork 0
mirror of https://github.com/Bubberstation/Bubberstation.git synced 2026-07-16 18:45:22 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #20732 from optimumtact/justhrefthings

Browse Source 
Fix multiple href exploits from incorrectly scoped locates
This commit is contained in:
Joan Lung
2016-09-28 19:00:44 -04:00
committed by GitHub
parent fde8904309 8b7eb11df9
commit aaefef46b8
10 changed files with 70 additions and 129 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/games/cards.dm
+2 -3
View File
@@ -264,9 +264,8 @@
if (istype(hclient))
switch (href_list["action"])
if ("play_card")
var/datum/playingcard/card = locate(href_list["card"])
if (card in src.cards)
var/datum/playingcard/card = locate(href_list["card"]) in cards
if (card && istype(card))
src.discard(card)
if ("toggle_conceal")
src.toggle_conceal()
code/modules/library/lib_machines.dm
+7 -5
View File
@@ -374,11 +374,13 @@ var/global/list/datum/cachedbook/cachedbooks // List of our cached book datums
b.duedate = world.time + (checkoutperiod * 600)
checkouts.Add(b)
if(href_list["checkin"])
var/datum/borrowbook/b = locate(href_list["checkin"])
checkouts.Remove(b)
var/datum/borrowbook/b = locate(href_list["checkin"]) in checkouts
if(b && istype(b))
checkouts.Remove(b)
if(href_list["delbook"])
var/obj/item/weapon/book/b = locate(href_list["delbook"])
inventory.Remove(b)
var/obj/item/weapon/book/b = locate(href_list["delbook"]) in inventory
if(b && istype(b))
inventory.Remove(b)
if(href_list["setauthor"])
var/newauthor = copytext(sanitize(input("Enter the author's name: ") as text|null),1,MAX_MESSAGE_LEN)
if(newauthor)
@@ -542,4 +544,4 @@ var/global/list/datum/cachedbook/cachedbooks // List of our cached book datums
B.icon_state = "book[rand(1,7)]"
qdel(P)
else
P.loc = loc
P.loc = loc
code/modules/mob/living/silicon/robot/robot.dm
+1 -85
View File
@@ -683,90 +683,6 @@
update_fire()
/mob/living/silicon/robot/proc/installed_modules()
if(!module)
pick_module()
return
var/dat = {"<A HREF='?src=\ref[src];mach_close=robotmod'>Close</A>
<BR>
<BR>
<B>Activated Modules</B>
<BR>
<table border='0'>
<tr><td>Module 1:</td><td>[module_state_1 ? "<A HREF=?src=\ref[src];mod=\ref[module_state_1]>[module_state_1]<A>" : "No Module"]</td></tr>
<tr><td>Module 2:</td><td>[module_state_2 ? "<A HREF=?src=\ref[src];mod=\ref[module_state_2]>[module_state_2]<A>" : "No Module"]</td></tr>
<tr><td>Module 3:</td><td>[module_state_3 ? "<A HREF=?src=\ref[src];mod=\ref[module_state_3]>[module_state_3]<A>" : "No Module"]</td></tr>
</table><BR>
<B>Installed Modules</B><BR><BR>
<table border='0'>"}
for (var/obj in module.modules)
if (!obj)
dat += text("<tr><td><B>Resource depleted</B></td></tr>")
else if(activated(obj))
dat += text("<tr><td>[obj]</td><td><B>Activated</B></td></tr>")
else
dat += text("<tr><td>[obj]</td><td><A HREF=?src=\ref[src];act=\ref[obj]>Activate</A></td></tr>")
if (emagged)
if(activated(module.emag))
dat += text("<tr><td>[module.emag]</td><td><B>Activated</B></td></tr>")
else
dat += text("<tr><td>[module.emag]</td><td><A HREF=?src=\ref[src];act=\ref[module.emag]>Activate</A></td></tr>")
dat += "</table>"
/*
if(activated(obj))
dat += text("[obj]: \[<B>Activated</B> | <A HREF=?src=\ref[src];deact=\ref[obj]>Deactivate</A>\]<BR>")
else
dat += text("[obj]: \[<A HREF=?src=\ref[src];act=\ref[obj]>Activate</A> | <B>Deactivated</B>\]<BR>")
*/
var/datum/browser/popup = new(src, "robotmod", "Modules")
popup.set_content(dat)
popup.open()
/mob/living/silicon/robot/Topic(href, href_list)
..()
if(usr && (src != usr))
return
if (href_list["mach_close"])
var/t1 = text("window=[href_list["mach_close"]]")
unset_machine()
src << browse(null, t1)
return
if (href_list["showalerts"])
robot_alerts()
return
if (href_list["mod"])
var/obj/item/O = locate(href_list["mod"])
if (O)
O.attack_self(src)
if (href_list["act"])
var/obj/item/O = locate(href_list["act"])
activate_module(O)
installed_modules()
if (href_list["deact"])
var/obj/item/O = locate(href_list["deact"])
if(activated(O))
if(module_state_1 == O)
module_state_1 = null
contents -= O
else if(module_state_2 == O)
module_state_2 = null
contents -= O
else if(module_state_3 == O)
module_state_3 = null
contents -= O
else
src << "Module isn't activated."
else
src << "Module isn't activated"
installed_modules()
#define BORG_CAMERA_BUFFER 30
/mob/living/silicon/robot/Move(a, b, flag)
var/oldLoc = src.loc
@@ -1161,4 +1077,4 @@
status_flags |= CANPUSH
return 1
return 1
code/modules/stock_market/computer.dm
+3 -8
View File
@@ -248,7 +248,7 @@ a.updated {
usr.machine = src
if (href_list["viewhistory"])
var/datum/stock/S = locate(href_list["viewhistory"])
var/datum/stock/S = locate(href_list["viewhistory"]) in stockExchange.stocks
if (S)
S.displayValues(usr)
@@ -256,20 +256,15 @@ a.updated {
logged_in = null
if (href_list["buyshares"])
var/datum/stock/S = locate(href_list["buyshares"])
var/datum/stock/S = locate(href_list["buyshares"]) in stockExchange.stocks
if (S)
buy_some_shares(S, usr)
if (href_list["sellshares"])
var/datum/stock/S = locate(href_list["sellshares"])
var/datum/stock/S = locate(href_list["sellshares"]) in stockExchange.stocks
if (S)
sell_some_shares(S, usr)
if (href_list["take"])
var/datum/borrow/B = locate(href_list["take"])
if (B && !B.lease_expires)
do_borrowing_deal(B, usr)
if (href_list["show_logs"])
var/dat = "<html><head><title>Stock Transaction Logs</title></head><body><h2>Stock Transaction Logs</h2><div><a href='?src=\ref[src];show_logs=1'>Refresh</a></div><br>"
for(var/D in stockExchange.logs)