//////////// //SECURITY// //////////// #define TOPIC_SPAM_DELAY 7 //7 tick delay is about half a second #define UPLOAD_LIMIT 10485760 //Restricts client uploads to the server to 10MB //Could probably do with being lower. /* When somebody clicks a link in game, this Topic is called first. It does the stuff in this proc and then is redirected to the Topic() proc for the src=[0xWhatever] (if specified in the link). ie locate(hsrc).Topic() Such links can be spoofed. Because of this certain things MUST be considered whenever adding a Topic() for something: - Can it be fed harmful values which could cause runtimes? - Is the Topic call an admin-only thing? - If so, does it have checks to see if the person who called it (usr.client) is an admin? - Are the processes being called by Topic() particularly laggy? - If so, is there any protection against somebody spam-clicking a link? If you have any questions about this stuff feel free to ask. ~Carn */ /client/Topic(href, href_list, hsrc) //Reduces spamming of links by dropping calls that happen during the delay period if(next_allowed_topic_time > world.time) // src << "\red DEBUG: Error: SPAM" return next_allowed_topic_time = world.time + TOPIC_SPAM_DELAY //search the href for script injection if( findtext(href,"[time2text(world.timeofday,"hh:mm")] [src] (usr:[usr]) || [href]
" if(view_var_Topic(href,href_list,hsrc)) //Until viewvars can be rewritten as datum/admins/Topic() return ..() //redirect to [locate(hsrc)]/Topic() //This stops files larger than UPLOAD_LIMIT being sent from client to server via input(), client.Import() etc. /client/AllowUpload(filename, filelength) if(filelength > UPLOAD_LIMIT) src << "Error: AllowUpload(): File Upload too large. Upload Limit: [UPLOAD_LIMIT/1024]KiB." return 0 /* //Don't need this at the moment. But it's here if it's needed later. //Helps prevent multiple files being uploaded at once. Or right after eachother. var/time_to_wait = fileaccess_timer - world.time if(time_to_wait > 0) src << "Error: AllowUpload(): Spam prevention. Please wait [round(time_to_wait/10)] seconds." return 0 fileaccess_timer = world.time + FTPDELAY */ world.log << "[src] uploaded [filename] of [filelength]" return 1 /////////// //CONNECT// /////////// /client/New() //Connection-Type Checking if( connection != "seeker" ) del(src) return if(IsGuestKey(key)) alert(src,"Baystation12 doesn't allow guest accounts to play. Please go to http://www.byond.com/ and register for a key.","Guest","OK") del(src) return if (((world.address == address || !(address)) && !(host))) host = key world.update_status() ..() //calls mob.Login() makejson() if(custom_event_msg && custom_event_msg != "") src << "

Custom Event

" src << "

A custom event is taking place. OOC Info:

" src << "[html_encode(custom_event_msg)]" src << "
" //Admin Authorisation if( ckey in admins ) holder = new /obj/admins(src) holder.rank = admins[ckey] update_admins(admins[ckey]) admin_memo_show() ////////////// //DISCONNECT// ////////////// /client/Del() spawn(0) if(holder) del(holder) makejson() return ..()