From 5424e835cd4405cf5484649977ca4e2a2dff5402 Mon Sep 17 00:00:00 2001 From: "johnsonmt88@gmail.com" Date: Fri, 4 May 2012 07:26:07 +0000 Subject: [PATCH] Sanitize added to agent cards and ID computer. git-svn-id: http://tgstation13.googlecode.com/svn/trunk@3556 316c924e-a436-60f5-8080-3fe189b3f50e --- code/game/machinery/computer/card.dm | 4 +++- code/game/objects/items/weapons/cards_ids.dm | 15 +++++++++++++-- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/code/game/machinery/computer/card.dm b/code/game/machinery/computer/card.dm index e404f9537c3..0f56300be6b 100644 --- a/code/game/machinery/computer/card.dm +++ b/code/game/machinery/computer/card.dm @@ -226,7 +226,9 @@ if (authenticated) var/t1 = href_list["assign_target"] if(t1 == "Custom") - t1 = input("Enter a custom job assignment.","Assignment") + var/temp_t = copytext(sanitize(input("Enter a custom job assignment.","Assignment")),1,MAX_MESSAGE_LEN) + if(temp_t) + t1 = temp_t else modify.access = ( istype(src,/obj/machinery/computer/card/centcom) ? get_centcom_access(t1) : get_access(t1) ) if (modify) diff --git a/code/game/objects/items/weapons/cards_ids.dm b/code/game/objects/items/weapons/cards_ids.dm index d0df06652d0..00351a1bdb8 100644 --- a/code/game/objects/items/weapons/cards_ids.dm +++ b/code/game/objects/items/weapons/cards_ids.dm @@ -54,8 +54,19 @@ FINGERPRINT CARD /obj/item/weapon/card/id/syndicate/attack_self(mob/user as mob) if(!src.registered_name) - src.registered_name = input(user, "What name would you like to put on this card?", "Agent card name", ishuman(user) ? user.real_name : user.name) - src.assignment = input(user, "What occupation would you like to put on this card?\nNote: This will not grant any access levels other than Maintenance.", "Agent card job assignment", "Assistant") + //Stop giving the players unsanitized unputs! You are giving ways for players to intentionally crash clients! -Nodrak + var t = copytext(sanitize(input(user, "What name would you like to put on this card?", "Agent card name", ishuman(user) ? user.real_name : user.name)),1,26) + if(!t || t == "Unknown" || t == "floor" || t == "wall" || t == "r-wall") //Same as mob/new_player/prefrences.dm + alert("Invalid name.") + return + src.registered_name = t + + var u = copytext(sanitize(input(user, "What occupation would you like to put on this card?\nNote: This will not grant any access levels other than Maintenance.", "Agent card job assignment", "Assistant")),1,MAX_MESSAGE_LEN) + if(!u) + alert("Invalid assignment.") + src.registered_name = "" + return + src.assignment = u src.name = "[src.registered_name]'s ID Card ([src.assignment])" user << "\blue You successfully forge the ID card." else