cyberpresidentvanellope/Bubberstation
1
0
Fork 0
mirror of https://github.com/Bubberstation/Bubberstation.git synced 2026-08-27 07:08:00 +01:00
Code Issues Packages Projects Releases Wiki Activity

Removes admin notices on failed logins in isbanned

Browse Source 
This could be used to spam admins, without them having any way to stop it, and as tobba has informed me, isbanned() is called before byond does much validation on the data (like checking that the claimed username exist or validating that they own it), leaving these notices vulnerable to html injection
This commit is contained in:
MrStonedOne
2015-04-15 10:11:37 -07:00
parent a9002da949
commit eb6279a5a4
1 changed files with 0 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/admin/IsBanned.dm
-3
View File
@@ -48,11 +48,9 @@ world/IsBanned(key,address,computer_id)
if(IsGuestKey(key))
if (!guests_allowed)
log_access("Failed Login: [key] - Guests not allowed")
message_admins("<span class='adminnotice'>Failed Login: [key] - Guests not allowed</span>")
return list("reason"="guest", "desc"="\nReason: Guests not allowed. Please sign in with a byond account.")
if (config.panic_bunker && dbcon && dbcon.IsConnected())
log_access("Failed Login: [key] - Guests not allowed during panic bunker")
message_admins("<span class='adminnotice'>Failed Login: [key] - Guests not allowed during panic bunker</span>")
return list("reason"="guest", "desc"="\nReason: Sorry but the server is currently not accepting connections from never before seen players or guests. If you have played on this server with a byond account before, please log in to the byond account you have played from.")
//Population Cap Checking
@@ -66,7 +64,6 @@ world/IsBanned(key,address,computer_id)
. = CheckBan( ckey(key), computer_id, address )
if(.)
log_access("Failed Login: [key] [computer_id] [address] - Banned [.["reason"]]")
message_admins("<span class='adminnotice'>Failed Login: [key] id:[computer_id] ip:[address] - Banned [.["reason"]]</span>")
return .
return ..() //default pager ban stuff