cyberpresidentvanellope/Paradise
1
0
Fork 0
mirror of https://github.com/ParadiseSS13/Paradise.git synced 2026-07-21 12:04:48 +01:00
Code Issues Packages Projects Releases Wiki Activity

[S] Yikes exploit fixes attempt 2 (#27248)

Browse Source 
* how did we miss this

* paper prevention

* optimise prime

* wow
This commit is contained in:
Sean
2024-10-31 17:57:28 +00:00
committed by GitHub
parent 02311c4787
commit 6257fef025
3 changed files with 143 additions and 122 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/paperwork/paper.dm
+12
View File
@@ -47,6 +47,7 @@
var/const/deffont = "Verdana"
var/const/signfont = "Times New Roman"
var/const/crayonfont = "Comic Sans MS"
var/regex/blacklist = new("(<iframe|<embed|<script|<canvas|<video|<audio|onload)", "g") // Blacklist of naughties
//lipstick wiping is in code/game/objects/items/weapons/cosmetics.dm!
@@ -314,6 +315,13 @@
\[time\] : Inserts the current station time in HH:MM:SS.<br>
</BODY></HTML>"}, "window=paper_help")
/obj/item/paper/vv_edit_var(var_name, var_value)
if((var_name == "info") && blacklist.Find(var_value)) //uh oh, they tried to be naughty
message_admins("<span class='danger'>EXPLOIT WARNING: ADMIN</span> [usr.ckey] attempted to write paper containing JS abusable tags!")
log_admin("EXPLOIT WARNING: ADMIN [usr.ckey] attempted to write paper containing JS abusable tags")
return FALSE
return ..()
/obj/item/paper/proc/topic_href_write(id, input_element)
var/obj/item/item_write = usr.get_active_hand() // Check to see if he still got that darn pen, also check if he's using a crayon or pen.
add_hiddenprint(usr) // No more forging nasty documents as someone else, you jerks
@@ -321,6 +329,10 @@
return
if(loc != usr && !Adjacent(usr) && !((istype(loc, /obj/item/clipboard) || istype(loc, /obj/item/folder)) && ((usr in get_turf(src)) || loc.Adjacent(usr))))
return // If paper is not in usr, then it must be near them, or in a clipboard or folder, which must be in or near usr
if(blacklist.Find(input_element)) //uh oh, they tried to be naughty
message_admins("<span class='danger'>EXPLOIT WARNING: </span> [usr.ckey] attempted to write paper containing JS abusable tags!")
log_admin("EXPLOIT WARNING: [usr.ckey] attempted to write paper containing JS abusable tags")
return FALSE
input_element = parsepencode(input_element, item_write, usr) // Encode everything from pencode to html
if(id != "end")
addtofield(text2num(id), input_element) // He wants to edit a field, let him.