cyberpresidentvanellope/Bubberstation
1
0
Fork 0
mirror of https://github.com/Bubberstation/Bubberstation.git synced 2026-08-22 20:48:56 +01:00
Code Issues Packages Projects Releases Wiki Activity

Replaces a bunch of input() with stripped_input()

Browse Source 
Some of these were exploitable for XSS, as well.
This commit is contained in:
tkdrg
2015-01-11 19:02:53 -03:00
parent 713da9344b
commit b852aa41ea
20 changed files with 29 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/game/objects/items/bodybag.dm
+1 -2
View File
@@ -44,12 +44,11 @@
/obj/structure/closet/body_bag/attackby(obj/item/I, mob/user)
if (istype(I, /obj/item/weapon/pen))
var/t = input(user, "What would you like the label to be?", name, null) as text
var/t = stripped_input(user, "What would you like the label to be?", name, null, 53)
if(user.get_active_hand() != I)
return
if(!in_range(src, user) && loc != user)
return
t = copytext(sanitize(t), 1, 53) //max length of 64 - "body bag - " instead of MAX_MESSAGE_LEN, as per the hand labeler
if(t)
name = "body bag - "
name += t
code/game/objects/items/devices/PDA/PDA.dm
+2 -3
View File
@@ -631,11 +631,10 @@ var/global/list/obj/item/device/pda/PDAs = list()
//CHATROOM FUNCTIONS====================================
if("Set Nick")
var/t = stripped_input(U, "Please enter nickname", name, null) as text
nick = copytext(sanitize(t), 1, 9)
var/t = stripped_input(U, "Please enter nickname", name, null, 8)
if("Set Channel")
var/t = stripped_input(U, "Please enter channel", name, (chat_channel)) as text
var/t = stripped_input(U, "Please enter channel", name, chat_channel)
if(t)
var/datum/chatroom/C = chatchannels[chat_channel]
code/game/objects/items/weapons/implants/implantcase.dm
+1 -2
View File
@@ -19,12 +19,11 @@
/obj/item/weapon/implantcase/attackby(obj/item/weapon/W, mob/user)
..()
if(istype(W, /obj/item/weapon/pen))
var/t = input(user, "What would you like the label to be?", name, null) as text
var/t = stripped_input(user, "What would you like the label to be?", name, null)
if(user.get_active_hand() != W)
return
if(!in_range(src, user) && loc != user)
return
t = copytext(sanitize(t), 1, MAX_MESSAGE_LEN)
if(t)
name = "glass case- '[t]'"
else
code/game/objects/structures/morgue.dm
+1 -2
View File
@@ -59,12 +59,11 @@
/obj/structure/bodycontainer/attackby(P as obj, mob/user as mob)
if (istype(P, /obj/item/weapon/pen))
var/t = input(user, "What would you like the label to be?", text("[]", name), null) as text
var/t = stripped_input(user, "What would you like the label to be?", text("[]", name), null)
if (user.get_active_hand() != P)
return
if ((!in_range(src, usr) && src.loc != user))
return
t = copytext(sanitize(t),1,MAX_MESSAGE_LEN)
if (t)
name = text("[]- '[]'", initial(name), t)
else