mirror of
https://github.com/Bubberstation/Bubberstation.git
synced 2025-12-17 05:03:28 +00:00
a297c06a0c
* Fixed a vulnerability introduced by the Request Music PR (#75691) Admins can proccall the web_sound proc, completely bypassing the shell_url_scrub done in other procs. Additionally, admins could just directly modify the request URL stored in the request manager so that it, again, bypasses the shell_url_scrub. This PR just moves the shell scrubbing directly inside the proc, right before the world.shelleo call, so that admins can't get around it with a proccall. * Fixed a vulnerability introduced by the Request Music PR --------- Co-authored-by: Watermelon914 <37270891+Watermelon914@users.noreply.github.com>