From 5dbe1c2458a9af8ebd0fa58b0829ef596b67ccd1 Mon Sep 17 00:00:00 2001 From: "vageyenaman@gmail.com" Date: Tue, 31 Jul 2012 07:55:03 +0000 Subject: [PATCH] This fixes an exploit that would let people use ChemMasters to spawn an infinite amount of any reagent. NEVER trust a clients' href input to be legitimate, always have failsafes. git-svn-id: http://tgstation13.googlecode.com/svn/trunk@4244 316c924e-a436-60f5-8080-3fe189b3f50e --- code/modules/chemical/Chemistry-Machinery.dm | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/code/modules/chemical/Chemistry-Machinery.dm b/code/modules/chemical/Chemistry-Machinery.dm index f851d7ef370..b72a2111aaa 100644 --- a/code/modules/chemical/Chemistry-Machinery.dm +++ b/code/modules/chemical/Chemistry-Machinery.dm @@ -263,26 +263,29 @@ usr << browse(dat, "window=chem_master;size=575x400") return else if (href_list["add1"]) + + /* + (this fixes a pretty serious exploit) ~~ Doohl R.remove_reagent(href_list["add1"], 1) //Remove/add used instead of trans_to since we're moving a specific reagent. reagents.add_reagent(href_list["add1"], 1) + */ + + R.trans_id_to(src, href_list["add1"], 1) + else if (href_list["add5"]) - R.remove_reagent(href_list["add5"], 5) - reagents.add_reagent(href_list["add5"], 5) + R.trans_id_to(src, href_list["add5"], 5) else if (href_list["add10"]) - R.remove_reagent(href_list["add10"], 10) - reagents.add_reagent(href_list["add10"], 10) + R.trans_id_to(src, href_list["add10"], 10) else if (href_list["addall"]) var/temp_amt = R.get_reagent_amount(href_list["addall"]) - reagents.add_reagent(href_list["addall"], temp_amt) - R.del_reagent(href_list["addall"]) + R.trans_id_to(src, href_list["addall"], temp_amt) else if (href_list["addcustom"]) var/id = href_list["addcustom"] useramount = input("Select the amount to transfer.", 30, useramount) as num useramount = isgoodnumber(useramount) var/realamount = R.get_reagent_amount(id) - R.remove_reagent(id, min(useramount, realamount)) - reagents.add_reagent(id, min(useramount, realamount)) + R.trans_id_to(src, href_list["addcustom"], realamount) else if (href_list["remove1"]) reagents.remove_reagent(href_list["remove1"], 1)