cyberpresidentvanellope/Paradise
1
0
Fork 0
mirror of https://github.com/ParadiseSS13/Paradise.git synced 2026-07-13 08:03:43 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #11515 from Tayyyyyyy/sanitize

Browse Source 
Sanitize all inputs
This commit is contained in:
variableundefined
2019-08-11 22:09:10 +08:00
committed by GitHub
parent eeeabc4380 80b3cae41e
commit 0b04d71445
37 changed files with 90 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/admin/admin_verbs.dm
+3 -3
View File
@@ -475,7 +475,7 @@ var/list/admin_verbs_ticket = list(
if(holder.fakekey)
holder.fakekey = null
else
var/new_key = ckeyEx(input("Enter your desired display name.", "Fake Key", key) as text|null)
var/new_key = ckeyEx(clean_input("Enter your desired display name.", "Fake Key", key))
if(!new_key) return
if(length(new_key) >= 26)
new_key = copytext(new_key, 1, 26)
@@ -497,7 +497,7 @@ var/list/admin_verbs_ticket = list(
holder.fakekey = null
holder.big_brother = 0
else
var/new_key = ckeyEx(input("Enter your desired display name. Unlike normal stealth mode, this will not appear in Who at all, except for other heads.", "Fake Key", key) as text|null)
var/new_key = ckeyEx(clean_input("Enter your desired display name. Unlike normal stealth mode, this will not appear in Who at all, except for other heads.", "Fake Key", key))
if(!new_key)
return
if(length(new_key) >= 26)
@@ -638,7 +638,7 @@ var/list/admin_verbs_ticket = list(
return
if(O)
var/message = input("What do you want the message to be?", "Make Sound") as text|null
var/message = clean_input("What do you want the message to be?", "Make Sound")
if(!message)
return
for(var/mob/V in hearers(O))
code/modules/admin/sql_notes.dm
+1 -1
View File
@@ -5,7 +5,7 @@
to_chat(usr, "<span class='danger'>Failed to establish database connection.</span>")
return
if(!target_ckey)
var/new_ckey = ckey(input(usr,"Who would you like to add a note for?","Enter a ckey",null) as text|null)
var/new_ckey = ckey(clean_input("Who would you like to add a note for?","Enter a ckey",null))
if(!new_ckey)
return
new_ckey = ckey(new_ckey)
code/modules/admin/stickyban.dm
+3 -3
View File
@@ -16,7 +16,7 @@
if(data["ckey"])
ckey = ckey(data["ckey"])
else
ckey = input(usr,"Ckey","Ckey","") as text|null
ckey = clean_input("Ckey","Ckey","")
if(!ckey)
return
ckey = ckey(ckey)
@@ -26,7 +26,7 @@
if(data["reason"])
ban["message"] = data["reason"]
else
var/reason = input(usr,"Reason","Reason","Ban Evasion") as text|null
var/reason = clean_input("Reason","Reason","Ban Evasion")
if(!reason)
return
ban["message"] = "[reason]"
@@ -112,7 +112,7 @@
to_chat(usr, "<span class='adminnotice'>Error: No sticky ban for [ckey] found!")
return
var/oldreason = ban["message"]
var/reason = input(usr,"Reason","Reason","[ban["message"]]") as text|null
var/reason = clean_input("Reason","Reason","[ban["message"]]")
if(!reason || reason == oldreason)
return
//we have to do this again incase something changed while we waited for input
code/modules/admin/topic.dm
+6 -6
View File
@@ -189,7 +189,7 @@
var/task = href_list["editrights"]
if(task == "add")
var/new_ckey = ckey(input(usr,"New admin's ckey","Admin ckey", null) as text|null)
var/new_ckey = ckey(clean_input("New admin's ckey","Admin ckey", null))
if(!new_ckey) return
if(new_ckey in admin_datums)
to_chat(usr, "<font color='red'>Error: Topic 'editrights': [new_ckey] is already an admin</font>")
@@ -1700,7 +1700,7 @@
var/eviltype = input(src.owner, "Which type of evil fax do you wish to send [H]?","Its good to be baaaad...", "") as null|anything in etypes
if(!(eviltype in etypes))
return
var/customname = input(src.owner, "Pick a title for the evil fax.", "Fax Title") as text|null
var/customname = clean_input("Pick a title for the evil fax.", "Fax Title", , owner)
if(!customname)
customname = "paper"
var/obj/item/paper/evilfax/P = new /obj/item/paper/evilfax(null)
@@ -2183,7 +2183,7 @@
return
input = P.parsepencode(input) // Encode everything from pencode to html
var/customname = input(src.owner, "Pick a title for the fax.", "Fax Title") as text|null
var/customname = clean_input("Pick a title for the fax.", "Fax Title", , owner)
if(!customname)
customname = "paper"
@@ -2216,14 +2216,14 @@
if("clown")
stampvalue = "clown"
else if(stamptype == "text")
stampvalue = input(src.owner, "What should the stamp say?", "Stamp Text") as text|null
stampvalue = clean_input("What should the stamp say?", "Stamp Text", , owner)
else if(stamptype == "none")
stamptype = ""
else
qdel(P)
return
sendername = input(src.owner, "What organization does the fax come from? This determines the prefix of the paper (i.e. Central Command- Title). This is optional.", "Organization") as text|null
sendername = clean_input("What organization does the fax come from? This determines the prefix of the paper (i.e. Central Command- Title). This is optional.", "Organization", , owner)
if(sender)
notify = alert(src.owner, "Would you like to inform the original sender that a fax has arrived?","Notify Sender","Yes","No")
@@ -3283,7 +3283,7 @@
return
var/datum/station_goal/G = new picked()
if(picked == /datum/station_goal)
var/newname = input("Enter goal name:") as text|null
var/newname = clean_input("Enter goal name:")
if(!newname)
return
G.name = newname
code/modules/admin/verbs/adminhelp.dm
+1 -1
View File
@@ -18,7 +18,7 @@ var/list/adminhelp_ignored_words = list("unknown","the","a","an","of","monkey","
var/list/type = list("Mentorhelp","Adminhelp")
var/selected_type = input("Pick a category.", "Admin Help", null, null) as null|anything in type
if(selected_type)
msg = input("Please enter your message.", "Admin Help", null, null) as text|null
msg = clean_input("Please enter your message.", "Admin Help", null)
//clean the input msg
if(!msg)
code/modules/admin/verbs/adminpm.dm
+5 -3
View File
@@ -89,7 +89,7 @@
//get message text, limit it's length.and clean/escape html
if(!msg)
set_typing(C, TRUE)
msg = input(src,"Message:", "Private message to [holder ? key_name(C, FALSE) : key_name_hidden(C, FALSE)]") as text|null
msg = clean_input("Message:", "Private message to [holder ? key_name(C, FALSE) : key_name_hidden(C, FALSE)]", , src)
set_typing(C, FALSE)
if(!msg)
@@ -109,6 +109,8 @@
msg = sanitize(copytext(msg,1,MAX_MESSAGE_LEN))
if(!msg)
return
else
msg = pencode_to_html(msg)
var/recieve_span = "playerreply"
var/send_pm_type = " "
@@ -147,7 +149,7 @@
spawn(0) //so we don't hold the caller proc up
var/sender = src
var/sendername = key
var/reply = input(C, msg,"[recieve_pm_type] [type] from-[sendername]", "") as text|null //show message and await a reply
var/reply = clean_input(msg,"[recieve_pm_type] [type] from-[sendername]", "", C) //show message and await a reply
if(C && reply)
if(sender)
C.cmd_admin_pm(sender,reply) //sender is still about, let's reply to them
@@ -216,7 +218,7 @@
to_chat(src, "<font color='red'>Error: Private-Message: You are unable to use PM-s (muted).</font>")
return
var/msg = input(src,"Message:", "Private message to admins on IRC / 400 character limit") as text|null
var/msg = clean_input("Message:", "Private message to admins on IRC / 400 character limit", , src) as text|null
if(!msg)
return
code/modules/admin/verbs/debug.dm
+4 -4
View File
@@ -68,7 +68,7 @@ But you can call procs that are of type /mob/living/carbon/human/proc/ for that
target = null
targetselected = 0
var/procname = input("Proc path, eg: /proc/fake_blood","Path:", null) as text|null
var/procname = clean_input("Proc path, eg: /proc/fake_blood","Path:", null)
if(!procname) return
if(targetselected && !hascall(target,procname))
@@ -102,7 +102,7 @@ But you can call procs that are of type /mob/living/carbon/human/proc/ for that
if(!check_rights(R_PROCCALL))
return
var/procname = input("Proc name, eg: fake_blood","Proc:", null) as text|null
var/procname = clean_input("Proc name, eg: fake_blood","Proc:", null)
if(!procname)
return
@@ -149,7 +149,7 @@ But you can call procs that are of type /mob/living/carbon/human/proc/ for that
return null
if("text")
lst += input("Enter new text:","Text",null) as text
lst += clean_input("Enter new text:","Text",null)
if("num")
lst += input("Enter new number:","Num",0) as num
@@ -271,7 +271,7 @@ But you can call procs that are of type /mob/living/carbon/human/proc/ for that
return 0
var/obj/item/paicard/card = new(T)
var/mob/living/silicon/pai/pai = new(card)
var/raw_name = input(choice, "Enter your pAI name:", "pAI Name", "Personal AI") as text
var/raw_name = clean_input("Enter your pAI name:", "pAI Name", "Personal AI", choice)
var/new_name = reject_bad_name(raw_name, 1)
if(new_name)
pai.name = new_name
code/modules/admin/verbs/diagnostics.dm
+2 -2
View File
@@ -145,7 +145,7 @@
if(!check_rights(R_DEBUG))
return
var/filter = input("Contains what?","Filter") as text|null
var/filter = clean_input("Contains what?","Filter")
if(!filter)
return
@@ -166,7 +166,7 @@
if(!check_rights(R_DEBUG))
return
var/refstring = input("Which reference?","Ref") as text|null
var/refstring = clean_input("Which reference?","Ref")
if(!refstring)
return
code/modules/admin/verbs/mapping.dm
+3 -3
View File
@@ -132,13 +132,13 @@ var/intercom_range_display_status = 0
if(!check_rights(R_DEBUG))
return
var/level = input("Which z-level?","Level?") as text
var/level = clean_input("Which z-level?","Level?")
if(!level) return
var/num_level = text2num(level)
if(!num_level) return
if(!isnum(num_level)) return
var/type_text = input("Which type path?","Path?") as text
var/type_text = clean_input("Which type path?","Path?")
if(!type_text) return
var/type_path = text2path(type_text)
if(!type_path) return
@@ -170,7 +170,7 @@ var/intercom_range_display_status = 0
if(!check_rights(R_DEBUG))
return
var/type_text = input("Which type path?","") as text
var/type_text = clean_input("Which type path?","")
if(!type_text) return
var/type_path = text2path(type_text)
if(!type_path) return
code/modules/admin/verbs/randomverbs.dm
+10 -7
View File
@@ -54,7 +54,7 @@
if(!check_rights(R_SERVER|R_EVENT))
return
var/msg = input("Message:", text("Subtle PM to [M.key]")) as text
var/msg = clean_input("Message:", text("Subtle PM to [M.key]"))
if(!msg)
return
@@ -109,10 +109,11 @@
if(!check_rights(R_SERVER|R_EVENT))
return
var/msg = input("Message:", text("Enter the text you wish to appear to everyone:")) as text
var/msg = clean_input("Message:", text("Enter the text you wish to appear to everyone:"))
if(!msg)
return
msg = pencode_to_html(msg)
to_chat(world, "[msg]")
log_admin("GlobalNarrate: [key_name(usr)] : [msg]")
message_admins("<span class='boldnotice'>GlobalNarrate: [key_name_admin(usr)]: [msg]<BR></span>", 1)
@@ -131,10 +132,11 @@
if(!M)
return
var/msg = input("Message:", text("Enter the text you wish to appear to your target:")) as text
var/msg = clean_input("Message:", text("Enter the text you wish to appear to your target:"))
if( !msg )
return
msg = pencode_to_html(msg)
to_chat(M, msg)
log_admin("DirectNarrate: [key_name(usr)] to ([key_name(M)]): [msg]")
@@ -169,7 +171,7 @@
return
message_admins("[key_name_admin(src)] has started answering [key_name_admin(H)]'s [sender] request.")
var/input = input("Please enter a message to reply to [key_name(H)] via their headset.", "Outgoing message from [sender]", "") as text|null
var/input = clean_input("Please enter a message to reply to [key_name(H)] via their headset.", "Outgoing message from [sender]", "")
if(!input)
message_admins("[key_name_admin(src)] decided not to answer [key_name_admin(H)]'s [sender] request.")
return
@@ -550,7 +552,7 @@ Traitors and the like can also be revived with the previous role mostly intact.
if(!check_rights(R_EVENT))
return
var/input = input(usr, "Please enter anything you want the AI to do. Anything. Serious.", "What?", "") as text|null
var/input = clean_input("Please enter anything you want the AI to do. Anything. Serious.", "What?", "")
if(!input)
return
@@ -603,14 +605,15 @@ Traitors and the like can also be revived with the previous role mostly intact.
var/type = input(usr, "Pick a type of report to send", "Report Type", "") as anything in MsgType
if(type == "Custom")
type = input(usr, "What would you like the report type to be?", "Report Type", "Encrypted Transmission") as text|null
type = clean_input("What would you like the report type to be?", "Report Type", "Encrypted Transmission")
var/customname = input(usr, "Pick a title for the report.", "Title", MsgType[type]) as text|null
var/customname = clean_input("Pick a title for the report.", "Title", MsgType[type])
if(!customname)
return
var/input = input(usr, "Please enter anything you want. Anything. Serious.", "What's the message?") as message|null
if(!input)
return
input = pencode_to_html(html_encode(input))
switch(alert("Should this be announced to the general population?",,"Yes","No", "Cancel"))
if("Yes")
code/modules/admin/watchlist.dm
+1 -1
View File
@@ -2,7 +2,7 @@
if(!check_rights(R_ADMIN))
return
if(!target_ckey)
var/new_ckey = ckey(input(usr,"Who would you like to add to the watchlist?","Enter a ckey",null) as text)
var/new_ckey = ckey(clean_input("Who would you like to add to the watchlist?","Enter a ckey",null))
if(!new_ckey)
return
new_ckey = sanitizeSQL(new_ckey)