mirror of
https://github.com/CHOMPStation2/CHOMPStation2.git
synced 2025-12-10 10:12:45 +00:00
Disable all shell() exec prox for extra security.
We do not use python or nodejs scripts. Our discord bot makes HTTP requests. Therefore we can entirely disable this code. Even if we ever want to start using these procs for discord integration, we would pipe it through our HTTP discord proxy, not use shell(). With all instances of shell() disabled, we can't be attacked by it.
This commit is contained in:
@@ -1,4 +1,5 @@
|
||||
/proc/send2irc(var/channel, var/msg)
|
||||
return // VOREStation Edit - Can't exploit shell if we never call shell!
|
||||
if (config.use_irc_bot)
|
||||
if (config.use_node_bot)
|
||||
shell("node bridge.js -h \"[config.irc_bot_host]\" -p \"[config.irc_bot_port]\" -c \"[channel]\" -m \"[msg]\"")
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
/proc/ext_python(var/script, var/args, var/scriptsprefix = 1)
|
||||
return // VOREStation Edit - Can't exploit shell if we never call shell!
|
||||
if(scriptsprefix) script = "scripts/" + script
|
||||
|
||||
if(world.system_type == MS_WINDOWS)
|
||||
|
||||
Reference in New Issue
Block a user