cyberpresidentvanellope/Paradise
1
0
Fork 0
mirror of https://github.com/ParadiseSS13/Paradise.git synced 2026-08-25 21:19:00 +01:00
Code Issues Packages Projects Releases Wiki Activity

Sanitize all inputs

Browse Source
This commit is contained in:
tayyyyyyy
2019-07-14 09:35:12 -07:00
committed by Tayyyyyyy
parent 4b3efa1ae1
commit 57c700a814
37 changed files with 86 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/admin/verbs/adminpm.dm
+5 -3
View File
@@ -89,7 +89,7 @@
//get message text, limit it's length.and clean/escape html
if(!msg)
set_typing(C, TRUE)
msg = input(src,"Message:", "Private message to [holder ? key_name(C, FALSE) : key_name_hidden(C, FALSE)]") as text|null
msg = clean_input("Message:", "Private message to [holder ? key_name(C, FALSE) : key_name_hidden(C, FALSE)]", , src)
set_typing(C, FALSE)
if(!msg)
@@ -109,6 +109,8 @@
msg = sanitize(copytext(msg,1,MAX_MESSAGE_LEN))
if(!msg)
return
else
msg = pencode_to_html(msg)
var/recieve_span = "playerreply"
var/send_pm_type = " "
@@ -147,7 +149,7 @@
spawn(0) //so we don't hold the caller proc up
var/sender = src
var/sendername = key
var/reply = input(C, msg,"[recieve_pm_type] [type] from-[sendername]", "") as text|null //show message and await a reply
var/reply = clean_input(msg,"[recieve_pm_type] [type] from-[sendername]", "", C) //show message and await a reply
if(C && reply)
if(sender)
C.cmd_admin_pm(sender,reply) //sender is still about, let's reply to them
@@ -216,7 +218,7 @@
to_chat(src, "<font color='red'>Error: Private-Message: You are unable to use PM-s (muted).</font>")
return
var/msg = input(src,"Message:", "Private message to admins on IRC / 400 character limit") as text|null
var/msg = clean_input("Message:", "Private message to admins on IRC / 400 character limit", , src) as text|null
if(!msg)
return