From 188593e452128a325087e9a36f05d8c2efdceb24 Mon Sep 17 00:00:00 2001 From: Rob Nelson Date: Wed, 14 May 2014 10:47:20 -0700 Subject: [PATCH] SECURITY FIX: Custom borg names sanitized and copytext'd to MAX_NAME_LEN --- code/game/gamemodes/objective.dm | 2 +- code/modules/mob/living/silicon/robot/robot.dm | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/code/game/gamemodes/objective.dm b/code/game/gamemodes/objective.dm index b4511a60145..f576b17e39e 100644 --- a/code/game/gamemodes/objective.dm +++ b/code/game/gamemodes/objective.dm @@ -562,7 +562,7 @@ datum/objective/steal var/tmp_obj = new O.typepath var/custom_name = tmp_obj:name del(tmp_obj) - O.name = copytext(sanitize(input("Enter target name:", "Objective target", custom_name) as text|null),1,MAX_MESSAGE_LEN) + O.name = copytext(sanitize(input("Enter target name:", "Objective target", custom_name) as text|null),1,MAX_NAME_LEN) if (!O.name) return steal_target = O explanation_text = "Steal [O.name]." diff --git a/code/modules/mob/living/silicon/robot/robot.dm b/code/modules/mob/living/silicon/robot/robot.dm index 2c60ed52090..af1839abeec 100644 --- a/code/modules/mob/living/silicon/robot/robot.dm +++ b/code/modules/mob/living/silicon/robot/robot.dm @@ -329,7 +329,7 @@ spawn(0) var/newname - newname = input(src,"You are a robot. Enter a name, or leave blank for the default name.", "Name change","") as text + newname = copytext(sanitize(input(src,"You are a robot. Enter a name, or leave blank for the default name.", "Name change","") as text),1,MAX_NAME_LEN) if (newname != "") custom_name = newname