From b1f76269b47602f22fc7eec6dc72f2419f32e9d0 Mon Sep 17 00:00:00 2001 From: Jordan Brown Date: Fri, 7 Jul 2017 10:29:14 -0400 Subject: [PATCH] Fixes permissions elevation exploit --- code/modules/admin/admin_ranks.dm | 5 +++++ code/modules/admin/holder2.dm | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/code/modules/admin/admin_ranks.dm b/code/modules/admin/admin_ranks.dm index 8356f693c69..39dd6828aee 100644 --- a/code/modules/admin/admin_ranks.dm +++ b/code/modules/admin/admin_ranks.dm @@ -67,6 +67,11 @@ GLOBAL_PROTECT(admin_ranks) // Adds/removes rights to this admin_rank /datum/admin_rank/proc/process_keyword(word, previous_rights=0) + if(IsAdminAdvancedProcCall()) + var/msg = " has tried to elevate permissions!" + message_admins("[key_name_admin(usr)][msg]") + log_admin_private("[key_name(usr)][msg]") + return var/flag = admin_keyword_to_flag(word, previous_rights) if(flag) switch(text2ascii(word,1)) diff --git a/code/modules/admin/holder2.dm b/code/modules/admin/holder2.dm index 6111c839be7..125ffb8209c 100644 --- a/code/modules/admin/holder2.dm +++ b/code/modules/admin/holder2.dm @@ -31,6 +31,11 @@ GLOBAL_PROTECT(admin_datums) GLOB.admin_datums[ckey] = src /datum/admins/proc/associate(client/C) + if(IsAdminAdvancedProcCall()) + var/msg = " has tried to elevate permissions!" + message_admins("[key_name_admin(usr)][msg]") + log_admin_private("[key_name(usr)][msg]") + return if(istype(C)) owner = C owner.holder = src