cyberpresidentvanellope/Paradise
1
0
Fork 0
mirror of https://github.com/ParadiseSS13/Paradise.git synced 2026-08-22 19:47:22 +01:00
Code Issues Packages Projects Releases Wiki Activity

Sanitize all inputs

Browse Source
This commit is contained in:
tayyyyyyy
2019-07-14 09:35:12 -07:00
committed by Tayyyyyyy
parent 4b3efa1ae1
commit 57c700a814
37 changed files with 86 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/admin/verbs/adminhelp.dm
+1 -1
View File
@@ -18,7 +18,7 @@ var/list/adminhelp_ignored_words = list("unknown","the","a","an","of","monkey","
var/list/type = list("Mentorhelp","Adminhelp")
var/selected_type = input("Pick a category.", "Admin Help", null, null) as null|anything in type
if(selected_type)
msg = input("Please enter your message.", "Admin Help", null, null) as text|null
msg = clean_input("Please enter your message.", "Admin Help", null)
//clean the input msg
if(!msg)
code/modules/admin/verbs/adminpm.dm
+5 -3
View File
@@ -89,7 +89,7 @@
//get message text, limit it's length.and clean/escape html
if(!msg)
set_typing(C, TRUE)
msg = input(src,"Message:", "Private message to [holder ? key_name(C, FALSE) : key_name_hidden(C, FALSE)]") as text|null
msg = clean_input("Message:", "Private message to [holder ? key_name(C, FALSE) : key_name_hidden(C, FALSE)]", , src)
set_typing(C, FALSE)
if(!msg)
@@ -109,6 +109,8 @@
msg = sanitize(copytext(msg,1,MAX_MESSAGE_LEN))
if(!msg)
return
else
msg = pencode_to_html(msg)
var/recieve_span = "playerreply"
var/send_pm_type = " "
@@ -147,7 +149,7 @@
spawn(0) //so we don't hold the caller proc up
var/sender = src
var/sendername = key
var/reply = input(C, msg,"[recieve_pm_type] [type] from-[sendername]", "") as text|null //show message and await a reply
var/reply = clean_input(msg,"[recieve_pm_type] [type] from-[sendername]", "", C) //show message and await a reply
if(C && reply)
if(sender)
C.cmd_admin_pm(sender,reply) //sender is still about, let's reply to them
@@ -216,7 +218,7 @@
to_chat(src, "<font color='red'>Error: Private-Message: You are unable to use PM-s (muted).</font>")
return
var/msg = input(src,"Message:", "Private message to admins on IRC / 400 character limit") as text|null
var/msg = clean_input("Message:", "Private message to admins on IRC / 400 character limit", , src) as text|null
if(!msg)
return
code/modules/admin/verbs/debug.dm
+4 -4
View File
@@ -68,7 +68,7 @@ But you can call procs that are of type /mob/living/carbon/human/proc/ for that
target = null
targetselected = 0
var/procname = input("Proc path, eg: /proc/fake_blood","Path:", null) as text|null
var/procname = clean_input("Proc path, eg: /proc/fake_blood","Path:", null)
if(!procname) return
if(targetselected && !hascall(target,procname))
@@ -102,7 +102,7 @@ But you can call procs that are of type /mob/living/carbon/human/proc/ for that
if(!check_rights(R_PROCCALL))
return
var/procname = input("Proc name, eg: fake_blood","Proc:", null) as text|null
var/procname = clean_input("Proc name, eg: fake_blood","Proc:", null)
if(!procname)
return
@@ -149,7 +149,7 @@ But you can call procs that are of type /mob/living/carbon/human/proc/ for that
return null
if("text")
lst += input("Enter new text:","Text",null) as text
lst += clean_input("Enter new text:","Text",null)
if("num")
lst += input("Enter new number:","Num",0) as num
@@ -271,7 +271,7 @@ But you can call procs that are of type /mob/living/carbon/human/proc/ for that
return 0
var/obj/item/paicard/card = new(T)
var/mob/living/silicon/pai/pai = new(card)
var/raw_name = input(choice, "Enter your pAI name:", "pAI Name", "Personal AI") as text
var/raw_name = clean_input("Enter your pAI name:", "pAI Name", "Personal AI", choice)
var/new_name = reject_bad_name(raw_name, 1)
if(new_name)
pai.name = new_name
code/modules/admin/verbs/diagnostics.dm
+2 -2
View File
@@ -145,7 +145,7 @@
if(!check_rights(R_DEBUG))
return
var/filter = input("Contains what?","Filter") as text|null
var/filter = clean_input("Contains what?","Filter")
if(!filter)
return
@@ -166,7 +166,7 @@
if(!check_rights(R_DEBUG))
return
var/refstring = input("Which reference?","Ref") as text|null
var/refstring = clean_input("Which reference?","Ref")
if(!refstring)
return
code/modules/admin/verbs/mapping.dm
+3 -3
View File
@@ -132,13 +132,13 @@ var/intercom_range_display_status = 0
if(!check_rights(R_DEBUG))
return
var/level = input("Which z-level?","Level?") as text
var/level = clean_input("Which z-level?","Level?")
if(!level) return
var/num_level = text2num(level)
if(!num_level) return
if(!isnum(num_level)) return
var/type_text = input("Which type path?","Path?") as text
var/type_text = clean_input("Which type path?","Path?")
if(!type_text) return
var/type_path = text2path(type_text)
if(!type_path) return
@@ -170,7 +170,7 @@ var/intercom_range_display_status = 0
if(!check_rights(R_DEBUG))
return
var/type_text = input("Which type path?","") as text
var/type_text = clean_input("Which type path?","")
if(!type_text) return
var/type_path = text2path(type_text)
if(!type_path) return
code/modules/admin/verbs/randomverbs.dm
+10 -7
View File
@@ -54,7 +54,7 @@
if(!check_rights(R_SERVER|R_EVENT))
return
var/msg = input("Message:", text("Subtle PM to [M.key]")) as text
var/msg = clean_input("Message:", text("Subtle PM to [M.key]"))
if(!msg)
return
@@ -109,10 +109,11 @@
if(!check_rights(R_SERVER|R_EVENT))
return
var/msg = input("Message:", text("Enter the text you wish to appear to everyone:")) as text
var/msg = clean_input("Message:", text("Enter the text you wish to appear to everyone:"))
if(!msg)
return
msg = pencode_to_html(msg)
to_chat(world, "[msg]")
log_admin("GlobalNarrate: [key_name(usr)] : [msg]")
message_admins("<span class='boldnotice'>GlobalNarrate: [key_name_admin(usr)]: [msg]<BR></span>", 1)
@@ -131,10 +132,11 @@
if(!M)
return
var/msg = input("Message:", text("Enter the text you wish to appear to your target:")) as text
var/msg = clean_input("Message:", text("Enter the text you wish to appear to your target:"))
if( !msg )
return
msg = pencode_to_html(msg)
to_chat(M, msg)
log_admin("DirectNarrate: [key_name(usr)] to ([key_name(M)]): [msg]")
@@ -169,7 +171,7 @@
return
message_admins("[key_name_admin(src)] has started answering [key_name_admin(H)]'s [sender] request.")
var/input = input("Please enter a message to reply to [key_name(H)] via their headset.", "Outgoing message from [sender]", "") as text|null
var/input = clean_input("Please enter a message to reply to [key_name(H)] via their headset.", "Outgoing message from [sender]", "")
if(!input)
message_admins("[key_name_admin(src)] decided not to answer [key_name_admin(H)]'s [sender] request.")
return
@@ -550,7 +552,7 @@ Traitors and the like can also be revived with the previous role mostly intact.
if(!check_rights(R_EVENT))
return
var/input = input(usr, "Please enter anything you want the AI to do. Anything. Serious.", "What?", "") as text|null
var/input = clean_input("Please enter anything you want the AI to do. Anything. Serious.", "What?", "")
if(!input)
return
@@ -603,14 +605,15 @@ Traitors and the like can also be revived with the previous role mostly intact.
var/type = input(usr, "Pick a type of report to send", "Report Type", "") as anything in MsgType
if(type == "Custom")
type = input(usr, "What would you like the report type to be?", "Report Type", "Encrypted Transmission") as text|null
type = clean_input("What would you like the report type to be?", "Report Type", "Encrypted Transmission")
var/customname = input(usr, "Pick a title for the report.", "Title", MsgType[type]) as text|null
var/customname = clean_input("Pick a title for the report.", "Title", MsgType[type])
if(!customname)
return
var/input = input(usr, "Please enter anything you want. Anything. Serious.", "What's the message?") as message|null
if(!input)
return
input = pencode_to_html(html_encode(input))
switch(alert("Should this be announced to the general population?",,"Yes","No", "Cancel"))
if("Yes")