mirror of
https://github.com/CHOMPStation2/CHOMPStation2.git
synced 2025-12-11 18:53:06 +00:00
86feaac9c2
they are banned. Another perk of using IsBanned and not client/New() is that we now disconnect potential clients before they are given a client object and start downloading any resources...which is like a 30Mb saving per failed login (after each server update). Tidied up the Login and Logout procs for mobs. Moved the sandbox buildmode stuff to mob/living/login.dm so you shouldn't have to log-out and back in to enable build mode. Removed the logged_in variable for mobs as it was the most pointless thing ever. Made the multikeying checks a separate proc. People are checked the second they get a new_player mob. Its notices are also less spammy. Changed AllowUpload from the default. It now restricts uploads of over 1Mb to prevent admins uploading massive .Oggs and lagging the server to hell whilst it sends the ogg to 40+ players. Feel free to change the limit. Moved some of the core client procs into one folder; they should really be together and not in /modules/mob/mob.dm and various other places. I will be giving the client stuff a belated spring-clean over the next few commits, just got to iron out some of the kinks. Revision: r3694 Author: elly1...@rocketmail.com
112 lines
3.7 KiB
Plaintext
112 lines
3.7 KiB
Plaintext
////////////
|
|
//SECURITY//
|
|
////////////
|
|
#define TOPIC_SPAM_DELAY 7 //7 tick delay is about half a second
|
|
#define UPLOAD_LIMIT 1048576 //Restricts client uploads to the server to 1MB //Could probably do with being lower.
|
|
/*
|
|
When somebody clicks a link in game, this Topic is called first.
|
|
It does the stuff in this proc and then is redirected to the Topic() proc for the src=[0xWhatever]
|
|
(if specified in the link). ie locate(hsrc).Topic()
|
|
|
|
Such links can be spoofed.
|
|
|
|
Because of this certain things MUST be considered whenever adding a Topic() for something:
|
|
- Can it be fed harmful values which could cause runtimes?
|
|
- Is the Topic call an admin-only thing?
|
|
- If so, does it have checks to see if the person who called it (usr.client) is an admin?
|
|
- Are the processes being called by Topic() particularly laggy?
|
|
- If so, is there any protection against somebody spam-clicking a link?
|
|
If you have any questions about this stuff feel free to ask. ~Carn
|
|
*/
|
|
/client/Topic(href, href_list, hsrc)
|
|
//Reduces spamming of links by dropping calls that happen during the delay period
|
|
if(next_allowed_topic_time > world.time)
|
|
// src << "\red DEBUG: Error: SPAM"
|
|
return
|
|
next_allowed_topic_time = world.time + TOPIC_SPAM_DELAY
|
|
|
|
//search the href for script injection
|
|
if( findtext(href,"<script",1,0) )
|
|
world.log << "Attempted use of scripts within a topic call, by [src]"
|
|
message_admins("Attempted use of scripts within a topic call, by [src]")
|
|
del(usr)
|
|
return
|
|
|
|
//Admin PM
|
|
if(href_list["priv_msg"])
|
|
var/client/C = locate(href_list["priv_msg"])
|
|
if(ismob(C)) //Old stuff can feed-in mobs instead of clients
|
|
var/mob/M = C
|
|
C = M.client
|
|
cmd_admin_pm(C,null)
|
|
return
|
|
|
|
//Logs all hrefs
|
|
if(config && config.log_hrefs && href_logfile)
|
|
href_logfile << "<small>[time2text(world.timeofday,"hh:mm")] [src] (usr:[usr])</small> || [href]<br>"
|
|
|
|
if(view_var_Topic(href,href_list,hsrc)) //Until viewvars can be rewritten as datum/admins/Topic()
|
|
return
|
|
|
|
..() //redirect to [locate(hsrc)]/Topic()
|
|
|
|
|
|
//This stops files larger than UPLOAD_LIMIT being sent from client to server via input(), client.Import() etc.
|
|
/client/AllowUpload(filename, filelength)
|
|
if(filelength > UPLOAD_LIMIT)
|
|
src << "<font color='red'>Error: AllowUpload(): File Upload too large. Upload Limit: [UPLOAD_LIMIT/1024]KiB.</font>"
|
|
return 0
|
|
/* //Don't need this at the moment. But it's here if it's needed later.
|
|
//Helps prevent multiple files being uploaded at once. Or right after eachother.
|
|
var/time_to_wait = fileaccess_timer - world.time
|
|
if(time_to_wait > 0)
|
|
src << "<font color='red'>Error: AllowUpload(): Spam prevention. Please wait [round(time_to_wait/10)] seconds.</font>"
|
|
return 0
|
|
fileaccess_timer = world.time + FTPDELAY */
|
|
return 1
|
|
|
|
|
|
///////////
|
|
//CONNECT//
|
|
///////////
|
|
/client/New()
|
|
//Connection-Type Checking
|
|
if( connection != "seeker" )
|
|
del(src)
|
|
return
|
|
|
|
if(IsGuestKey(key))
|
|
alert(src,"Baystation12 doesn't allow guest accounts to play. Please go to http://www.byond.com/ and register for a key.","Guest","OK")
|
|
del(src)
|
|
return
|
|
|
|
if (((world.address == address || !(address)) && !(host)))
|
|
host = key
|
|
world.update_status()
|
|
|
|
..() //calls mob.Login()
|
|
makejson()
|
|
|
|
if(custom_event_msg && custom_event_msg != "")
|
|
src << "<h1 class='alert'>Custom Event</h1>"
|
|
src << "<h2 class='alert'>A custom event is taking place. OOC Info:</h2>"
|
|
src << "<span class='alert'>[html_encode(custom_event_msg)]</span>"
|
|
src << "<br>"
|
|
|
|
//Admin Authorisation
|
|
if( ckey in admins )
|
|
holder = new /obj/admins(src)
|
|
holder.rank = admins[ckey]
|
|
update_admins(admins[ckey])
|
|
admin_memo_show()
|
|
|
|
|
|
//////////////
|
|
//DISCONNECT//
|
|
//////////////
|
|
/client/Del()
|
|
spawn(0)
|
|
if(holder)
|
|
del(holder)
|
|
makejson()
|
|
return ..() |