From 6e289dabfca81bf3a81afa526b595a532ce641a0 Mon Sep 17 00:00:00 2001 From: Erthilo Date: Sat, 26 May 2012 00:09:56 +0100 Subject: [PATCH] TG: Sanitized a large number of input()s. - Hopefully this will cut down on the server spamming/crashing escapades happening on other servers. (This wont stop that from happening, this just makes it less severe) - Some of the sanitizes were probably unnecessary, but better safe then sorry. Added MAX_NAME_LEN constant which is initialized to 26. - Please use MAX_NAME_LEN instead of typing in 26 when cutting inputs short. 26's are annoying when they have to be changed and you have to hunt through over a hundred files and tens of thousands of lines of code to find them all. Moved uplink_kits.dm to code/game/objects/storage Moved uplinks.dm to code/game/objects - The stuff inside uplinks.dm could really be chopped up and split into separate dm files but this will do for now. ********************************************************* **********************Important************************** ********************************************************* When you create code that asks the user for an input consider whether or not it gets shown to the user through html or the like. If it does please sanatize() or strip_html() it. Also use copytext() to cutoff spam by using MAX_NAME_LEN and MAX_MESSAGE_LEN as the cutoff var. Revision: r3652 Author: johnsonmt88 --- baystation12.dme | 4 +- code/datums/datumvars.dm | 2 +- code/datums/mind.dm | 4 +- code/defines/global.dm | 2 + code/defines/procs/helpers.dm | 18 +- code/game/events/EventProcs/space_ninja.dm | 2 +- code/game/gamemodes/nuclear/nuclear.dm | 11 +- code/game/gamemodes/objective.dm | 3 +- code/game/gamemodes/wizard/wizard.dm | 8 +- code/game/jobs/job/civilian_chaplain.dm | 13 +- code/game/machinery/bots/mulebot.dm | 4 +- .../game/machinery/computer/communications.dm | 6 +- code/game/machinery/computer/medical.dm | 26 +- code/game/machinery/computer/prisoner.dm | 3 +- code/game/machinery/computer/security.dm | 18 +- code/game/machinery/magnet.dm | 2 +- code/game/machinery/navbeacon.dm | 2 +- code/game/machinery/requests_console.dm | 4 +- .../telecomms/machine_interactions.dm | 2 +- code/game/magic/cultist/runes.dm | 2 +- code/game/magic/library.dm | 17 +- code/game/objects/devices/paicard.dm | 2 +- code/game/objects/items/robot_parts.dm | 2 +- code/game/objects/items/weapons/AI_modules.dm | 20 +- code/game/objects/items/weapons/explosives.dm | 4 +- .../objects/items/weapons/wrappingpaper.dm | 3 +- code/game/objects/storage/uplink_kits.dm | 53 ++ code/game/objects/uplinks.dm | 461 ++++++++++++++++++ code/game/supplyshuttle.dm | 10 +- code/modules/admin/admin.dm | 5 +- code/modules/admin/verbs/striketeam.dm | 2 +- .../admin/verbs/striketeam_syndicate.dm | 2 +- code/modules/mob/living/carbon/human/emote.dm | 2 +- .../modules/mob/living/silicon/robot/emote.dm | 3 +- code/modules/mob/new_player/preferences.dm | 26 +- code/modules/paperwork/folders.dm | 3 +- code/modules/paperwork/handlabeler.dm | 5 +- code/modules/paperwork/paper.dm | 2 +- .../projectiles/guns/projectile/revolver.dm | 3 +- code/modules/recycling/sortingmachinery.dm | 30 +- 40 files changed, 627 insertions(+), 164 deletions(-) create mode 100644 code/game/objects/storage/uplink_kits.dm create mode 100644 code/game/objects/uplinks.dm diff --git a/baystation12.dme b/baystation12.dme index fd0b229b659..9103ff1b305 100644 --- a/baystation12.dme +++ b/baystation12.dme @@ -648,6 +648,7 @@ #include "code\game\objects\tank.dm" #include "code\game\objects\toys.dm" #include "code\game\objects\transfer_valve.dm" +#include "code\game\objects\uplinks.dm" #include "code\game\objects\washing_machine.dm" #include "code\game\objects\watercloset.dm" #include "code\game\objects\weapons.dm" @@ -773,6 +774,7 @@ #include "code\game\objects\storage\lockbox.dm" #include "code\game\objects\storage\storage.dm" #include "code\game\objects\storage\toolbox.dm" +#include "code\game\objects\storage\uplink_kits.dm" #include "code\game\objects\tanks\emergency.dm" #include "code\game\objects\tanks\jetpack.dm" #include "code\game\objects\tanks\oxygen.dm" @@ -1182,8 +1184,6 @@ #include "code\WorkInProgress\organs\organs.dm" #include "code\WorkInProgress\Ported\head.dm" #include "code\WorkInProgress\Ported\policetape.dm" -#include "code\WorkInProgress\Ported\Abi79\uplink_kits.dm" -#include "code\WorkInProgress\Ported\Abi79\uplinks.dm" #include "code\WorkInProgress\Ported\Bureaucracy\copier.dm" #include "code\WorkInProgress\Ported\Bureaucracy\filing.dm" #include "code\WorkInProgress\SkyMarshal\coatrack.dm" diff --git a/code/datums/datumvars.dm b/code/datums/datumvars.dm index c328dd98d1b..8f41138e108 100644 --- a/code/datums/datumvars.dm +++ b/code/datums/datumvars.dm @@ -418,7 +418,7 @@ client/Topic(href, href_list, hsrc) //~CARN: for renaming mobs (updates their real_name and their ID/PDA if applicable). else if (href_list["rename"]) - var/new_name = input(usr,"What would you like to name this mob?","Input a name") as text|null + var/new_name = copytext(sanitize(input(usr,"What would you like to name this mob?","Input a name") as text|null),1,MAX_NAME_LEN) if(!new_name) return var/mob/M = locate(href_list["rename"]) if(!istype(M)) return diff --git a/code/datums/mind.dm b/code/datums/mind.dm index eb2d7b924a7..9be4f6423fb 100644 --- a/code/datums/mind.dm +++ b/code/datums/mind.dm @@ -305,7 +305,7 @@ datum/mind role_alt_title = null else if (href_list["memory_edit"]) - var/new_memo = input("Write new memory", "Memory", memory) as null|message + var/new_memo = copytext(sanitize(input("Write new memory", "Memory", memory) as null|message),1,MAX_MESSAGE_LEN) if (isnull(new_memo)) return memory = new_memo @@ -408,7 +408,7 @@ datum/mind new_objective:target_amount = target_number if ("custom") - var/expl = input("Custom objective:", "Objective", objective ? objective.explanation_text : "") as text|null + var/expl = copytext(sanitize(input("Custom objective:", "Objective", objective ? objective.explanation_text : "") as text|null),1,MAX_MESSAGE_LEN) if (!expl) return new_objective = new /datum/objective new_objective.owner = src diff --git a/code/defines/global.dm b/code/defines/global.dm index eea4addf107..6754b7b7925 100644 --- a/code/defines/global.dm +++ b/code/defines/global.dm @@ -190,6 +190,8 @@ var const/MAX_PAPER_MESSAGE_LEN = 3072 const/MAX_BOOK_MESSAGE_LEN = 9216 + const/MAX_NAME_LEN = 26 + list/paper_blacklist = list("script","frame","iframe","input","button","a","embed","object") const/shuttle_time_in_station = 1800 // 3 minutes in the station diff --git a/code/defines/procs/helpers.dm b/code/defines/procs/helpers.dm index e128be4cf8c..8a2d3311421 100644 --- a/code/defines/procs/helpers.dm +++ b/code/defines/procs/helpers.dm @@ -692,15 +692,15 @@ Turf and target are seperate in case you want to teleport some distance from a t /proc/ainame(var/mob/M as mob) var/randomname = M.name var/time_passed = world.time//Pretty basic but it'll do. It's still possible to bypass this by return ainame(). - var/newname = input(M,"You are the AI. Would you like to change your name to something else?", "Name change",randomname) + var/newname = copytext(sanitize(input(M,"You are the AI. Would you like to change your name to something else?", "Name change",randomname)),1,MAX_NAME_LEN) if((world.time-time_passed)>200)//If more than 20 game seconds passed. M << "You took too long to decide. Default name selected." return - if (length(newname) == 0) + if (!newname) newname = randomname - if (newname) + else if (newname == "Inactive AI")//Keeping this here to prevent dumb. M << "That name is reserved." return ainame(M) @@ -708,22 +708,19 @@ Turf and target are seperate in case you want to teleport some distance from a t if (A.real_name == newname&&newname!=randomname) M << "There's already an AI with that name." return ainame(M) - if (length(newname) >= 26) - newname = copytext(newname, 1, 26) - newname = dd_replacetext(newname, ">", "'") M.real_name = newname M.name = newname M.original_name = newname /*/proc/clname(var/mob/M as mob) //--All praise goes to NEO|Phyte, all blame goes to DH, and it was Cindi-Kate's idea var/randomname = pick(clown_names) - var/newname = input(M,"You are the clown. Would you like to change your name to something else?", "Name change",randomname) + var/newname = copytext(sanitize(input(M,"You are the clown. Would you like to change your name to something else?", "Name change",randomname)),1,MAX_NAME_LEN) var/oldname = M.real_name - if (length(newname) == 0) + if (!newname) newname = randomname - if (newname) + else var/badname = 0 switch(newname) if("Unknown") badname = 1 @@ -740,9 +737,6 @@ Turf and target are seperate in case you want to teleport some distance from a t if(A.real_name == newname) M << "That name is reserved." return clname(M) - if(length(newname) >= 26) - newname = copytext(newname, 1, 26) - newname = dd_replacetext(newname, ">", "'") M.real_name = newname M.name = newname M.original_name = newname diff --git a/code/game/events/EventProcs/space_ninja.dm b/code/game/events/EventProcs/space_ninja.dm index c600efd4057..ca89012651c 100644 --- a/code/game/events/EventProcs/space_ninja.dm +++ b/code/game/events/EventProcs/space_ninja.dm @@ -409,7 +409,7 @@ As such, it's hard-coded for now. No reason for it not to be, really. var/mission while(!mission) - mission = input(src, "Please specify which mission the space ninja shall undertake.", "Specify Mission", "") + mission = copytext(sanitize(input(src, "Please specify which mission the space ninja shall undertake.", "Specify Mission", "")),1,MAX_MESSAGE_LEN) if(!mission) if(alert("Error, no mission set. Do you want to exit the setup process?",,"Yes","No")=="Yes") return diff --git a/code/game/gamemodes/nuclear/nuclear.dm b/code/game/gamemodes/nuclear/nuclear.dm index 91f56fd4f9e..c59807054a1 100644 --- a/code/game/gamemodes/nuclear/nuclear.dm +++ b/code/game/gamemodes/nuclear/nuclear.dm @@ -339,18 +339,15 @@ /proc/nukelastname(var/mob/M as mob) //--All praise goes to NEO|Phyte, all blame goes to DH, and it was Cindi-Kate's idea. Also praise Urist for copypasta ho. var/randomname = pick(last_names) - var/newname = input(M,"You are the nuke operative [pick("Czar", "Boss", "Commander", "Chief", "Kingpin", "Director", "Overlord")]. Please choose a last name for your family.", "Name change",randomname) + var/newname = copytext(sanitize(input(M,"You are the nuke operative [pick("Czar", "Boss", "Commander", "Chief", "Kingpin", "Director", "Overlord")]. Please choose a last name for your family.", "Name change",randomname)),1,MAX_NAME_LEN) - if (length(newname) == 0) + if (!newname) newname = randomname - if (newname) - if (newname == "Unknown") + else + if (newname == "Unknown" || newname == "floor" || newname == "wall" || newname == "rwall" || newname == "_") M << "That name is reserved." return nukelastname(M) - if (length(newname) >= 26) - newname = copytext(newname, 1, 26) - newname = dd_replacetext(newname, ">", "'") return newname diff --git a/code/game/gamemodes/objective.dm b/code/game/gamemodes/objective.dm index 632fdca82f7..3c01abe6679 100644 --- a/code/game/gamemodes/objective.dm +++ b/code/game/gamemodes/objective.dm @@ -334,7 +334,7 @@ datum/objective/steal var/tmp_obj = new custom_target var/custom_name = tmp_obj:name del(tmp_obj) - custom_name = input("Enter target name:", "Objective target", custom_name) as text|null + custom_name = copytext(sanitize(input("Enter target name:", "Objective target", custom_name) as text|null),1,MAX_MESSAGE_LEN) if (!custom_name) return target_name = custom_name steal_target = custom_target @@ -343,7 +343,6 @@ datum/objective/steal set_target(new_target) return steal_target - check_completion() if(!steal_target || !owner.current) return 0 if(!isliving(owner.current)) return 0 diff --git a/code/game/gamemodes/wizard/wizard.dm b/code/game/gamemodes/wizard/wizard.dm index a3eff11b365..885b32ccdd5 100644 --- a/code/game/gamemodes/wizard/wizard.dm +++ b/code/game/gamemodes/wizard/wizard.dm @@ -72,15 +72,11 @@ var/wizard_name_second = pick(wizard_second) var/randomname = "[wizard_name_first] [wizard_name_second]" spawn(0) - var/newname = input(wizard_mob, "You are the Space Wizard. Would you like to change your name to something else?", "Name change", randomname) as null|text + var/newname = copytext(sanitize(input(wizard_mob, "You are the Space Wizard. Would you like to change your name to something else?", "Name change", randomname) as null|text),1,MAX_NAME_LEN) - if (length(newname) == 0) + if (!newname) newname = randomname - if (newname) - if (length(newname) >= 26) - newname = copytext(newname, 1, 26) - newname = dd_replacetext(newname, ">", "'") wizard_mob.real_name = newname wizard_mob.name = newname return diff --git a/code/game/jobs/job/civilian_chaplain.dm b/code/game/jobs/job/civilian_chaplain.dm index 6f80d8ec9bb..0871a8977f4 100644 --- a/code/game/jobs/job/civilian_chaplain.dm +++ b/code/game/jobs/job/civilian_chaplain.dm @@ -21,15 +21,11 @@ H.equip_if_possible(new /obj/item/clothing/shoes/black(H), H.slot_shoes) spawn(0) var/religion_name = "Christianity" - var/new_religion = input(H, "You are the Chaplain / Counselor. For game mechanics purposes, you need to choose a religion either way. Would you like to change your religion? Default is Christianity, in SPACE.", "Name change", religion_name) + var/new_religion = copytext(sanitize(input(H, "You are the Chaplain / Counselor. For game mechanics purposes, you need to choose a religion either way. Would you like to change your religion? Default is Christianity, in SPACE.", "Name change", religion_name)),1,MAX_NAME_LEN) if ((length(new_religion) == 0) || (new_religion == "Christianity")) new_religion = religion_name - if (new_religion) - if (length(new_religion) >= 26) - new_religion = copytext(new_religion, 1, 26) - new_religion = dd_replacetext(new_religion, ">", "'") switch(lowertext(new_religion)) if("christianity") B.name = pick("The Holy Bible","The Dead Sea Scrolls") @@ -53,15 +49,10 @@ spawn(1) var/deity_name = "Space Jesus" - var/new_deity = input(H, "Would you like to change your deity? Default is Space Jesus.", "Name change", deity_name) + var/new_deity = copytext(sanitize(input(H, "Would you like to change your deity? Default is Space Jesus.", "Name change", deity_name)),1,MAX_NAME_LEN) if ((length(new_deity) == 0) || (new_deity == "Space Jesus") ) new_deity = deity_name - - if(new_deity) - if (length(new_deity) >= 26) - new_deity = copytext(new_deity, 1, 26) - new_deity = dd_replacetext(new_deity, ">", "'") B.deity_name = new_deity var/accepted = 0 diff --git a/code/game/machinery/bots/mulebot.dm b/code/game/machinery/bots/mulebot.dm index 9d720356481..fe00a74c636 100644 --- a/code/game/machinery/bots/mulebot.dm +++ b/code/game/machinery/bots/mulebot.dm @@ -377,7 +377,7 @@ if("setid") refresh=0 - var/new_id = input("Enter new bot ID", "Mulebot [suffix ? "([suffix])" : ""]", suffix) as text|null + var/new_id = copytext(sanitize(input("Enter new bot ID", "Mulebot [suffix ? "([suffix])" : ""]", suffix) as text|null),1,MAX_NAME_LEN) refresh=1 if(new_id) suffix = new_id @@ -962,4 +962,4 @@ new /obj/effect/decal/cleanable/oil(src.loc) unload(0) - del(src) \ No newline at end of file + del(src) diff --git a/code/game/machinery/computer/communications.dm b/code/game/machinery/computer/communications.dm index fb4b4e1b2f9..84c936a4266 100644 --- a/code/game/machinery/computer/communications.dm +++ b/code/game/machinery/computer/communications.dm @@ -98,7 +98,7 @@ if("announce") if(src.authenticated==2) if(message_cooldown) return - var/input = input(usr, "Please choose a message to announce to the station crew.", "What?", "") + var/input = copytext(sanitize(input(usr, "Please choose a message to announce to the station crew.", "What?", "")),1,MAX_MESSAGE_LEN) if(!input || !(usr in view(1,src))) return captain_announce(input)//This should really tell who is, IE HoP, CE, HoS, RD, Captain @@ -187,7 +187,7 @@ if(centcomm_message_cooldown) usr << "Arrays recycling. Please stand by." return - var/input = input(usr, "Please choose a message to transmit to Centcomm via quantum entanglement. Please be aware that this process is very expensive, and abuse will lead to... termination. Transmission does not guarantee a response.", "To abort, send an empty message.", "") + var/input = copytext(sanitize(input(usr, "Please choose a message to transmit to Centcomm via quantum entanglement. Please be aware that this process is very expensive, and abuse will lead to... termination. Transmission does not guarantee a response.", "To abort, send an empty message.", "")),1,MAX_MESSAGE_LEN) if(!input || !(usr in view(1,src))) return Centcomm_announce(input, usr) @@ -204,7 +204,7 @@ if(centcomm_message_cooldown) usr << "Arrays recycling. Please stand by." return - var/input = input(usr, "Please choose a message to transmit to \[ABNORMAL ROUTING CORDINATES\] via quantum entanglement. Please be aware that this process is very expensive, and abuse will lead to... termination. Transmission does not guarantee a response.", "To abort, send an empty message.", "") + var/input = copytext(sanitize(input(usr, "Please choose a message to transmit to \[ABNORMAL ROUTING CORDINATES\] via quantum entanglement. Please be aware that this process is very expensive, and abuse will lead to... termination. Transmission does not guarantee a response.", "To abort, send an empty message.", "")),1,MAX_MESSAGE_LEN) if(!input || !(usr in view(1,src))) return Syndicate_announce(input, usr) diff --git a/code/game/machinery/computer/medical.dm b/code/game/machinery/computer/medical.dm index 56b5e8c1af5..b25043f1f8e 100644 --- a/code/game/machinery/computer/medical.dm +++ b/code/game/machinery/computer/medical.dm @@ -293,7 +293,7 @@ switch(href_list["field"]) if("fingerprint") if (istype(src.active1, /datum/data/record)) - var/t1 = input("Please input fingerprint hash:", "Med. records", src.active1.fields["fingerprint"], null) as text + var/t1 = copytext(sanitize(input("Please input fingerprint hash:", "Med. records", src.active1.fields["fingerprint"], null) as text),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active1 != a1)) return src.active1.fields["fingerprint"] = t1 @@ -305,61 +305,61 @@ src.active1.fields["sex"] = "Male" if("age") if (istype(src.active1, /datum/data/record)) - var/t1 = input("Please input age:", "Med. records", src.active1.fields["age"], null) as text + var/t1 = input("Please input age:", "Med. records", src.active1.fields["age"], null) as num if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active1 != a1)) return src.active1.fields["age"] = t1 if("mi_dis") if (istype(src.active2, /datum/data/record)) - var/t1 = input("Please input minor disabilities list:", "Med. records", src.active2.fields["mi_dis"], null) as text + var/t1 = copytext(sanitize(input("Please input minor disabilities list:", "Med. records", src.active2.fields["mi_dis"], null) as text),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active2 != a2)) return src.active2.fields["mi_dis"] = t1 if("mi_dis_d") if (istype(src.active2, /datum/data/record)) - var/t1 = input("Please summarize minor dis.:", "Med. records", src.active2.fields["mi_dis_d"], null) as message + var/t1 = copytext(sanitize(input("Please summarize minor dis.:", "Med. records", src.active2.fields["mi_dis_d"], null) as message),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active2 != a2)) return src.active2.fields["mi_dis_d"] = t1 if("ma_dis") if (istype(src.active2, /datum/data/record)) - var/t1 = input("Please input major diabilities list:", "Med. records", src.active2.fields["ma_dis"], null) as text + var/t1 = copytext(sanitize(input("Please input major diabilities list:", "Med. records", src.active2.fields["ma_dis"], null) as text),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active2 != a2)) return src.active2.fields["ma_dis"] = t1 if("ma_dis_d") if (istype(src.active2, /datum/data/record)) - var/t1 = input("Please summarize major dis.:", "Med. records", src.active2.fields["ma_dis_d"], null) as message + var/t1 = copytext(sanitize(input("Please summarize major dis.:", "Med. records", src.active2.fields["ma_dis_d"], null) as message),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active2 != a2)) return src.active2.fields["ma_dis_d"] = t1 if("alg") if (istype(src.active2, /datum/data/record)) - var/t1 = input("Please state allergies:", "Med. records", src.active2.fields["alg"], null) as text + var/t1 = copytext(sanitize(input("Please state allergies:", "Med. records", src.active2.fields["alg"], null) as text),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active2 != a2)) return src.active2.fields["alg"] = t1 if("alg_d") if (istype(src.active2, /datum/data/record)) - var/t1 = input("Please summarize allergies:", "Med. records", src.active2.fields["alg_d"], null) as message + var/t1 = copytext(sanitize(input("Please summarize allergies:", "Med. records", src.active2.fields["alg_d"], null) as message),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active2 != a2)) return src.active2.fields["alg_d"] = t1 if("cdi") if (istype(src.active2, /datum/data/record)) - var/t1 = input("Please state diseases:", "Med. records", src.active2.fields["cdi"], null) as text + var/t1 = copytext(sanitize(input("Please state diseases:", "Med. records", src.active2.fields["cdi"], null) as text),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active2 != a2)) return src.active2.fields["cdi"] = t1 if("cdi_d") if (istype(src.active2, /datum/data/record)) - var/t1 = input("Please summarize diseases:", "Med. records", src.active2.fields["cdi_d"], null) as message + var/t1 = copytext(sanitize(input("Please summarize diseases:", "Med. records", src.active2.fields["cdi_d"], null) as message),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active2 != a2)) return src.active2.fields["cdi_d"] = t1 if("notes") if (istype(src.active2, /datum/data/record)) - var/t1 = input("Please summarize notes:", "Med. records", src.active2.fields["notes"], null) as message + var/t1 = copytext(sanitize(input("Please summarize notes:", "Med. records", src.active2.fields["notes"], null) as message),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active2 != a2)) return src.active2.fields["notes"] = t1 @@ -374,7 +374,7 @@ src.temp = text("Blood Type:
\n\tA- A+
\n\tB- B+
\n\tAB- AB+
\n\tO- O+
", src, src, src, src, src, src, src, src) if("b_dna") if (istype(src.active1, /datum/data/record)) - var/t1 = input("Please input DNA hash:", "Med. records", src.active1.fields["dna"], null) as text + var/t1 = copytext(sanitize(input("Please input DNA hash:", "Med. records", src.active1.fields["dna"], null) as text),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active1 != a1)) return src.active1.fields["dna"] = t1 @@ -475,7 +475,7 @@ if (!( istype(src.active2, /datum/data/record) )) return var/a2 = src.active2 - var/t1 = input("Add Comment:", "Med. records", null, null) as message + var/t1 = copytext(sanitize(input("Add Comment:", "Med. records", null, null) as message),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active2 != a2)) return var/counter = 1 diff --git a/code/game/machinery/computer/prisoner.dm b/code/game/machinery/computer/prisoner.dm index efde1f1f012..61e26796260 100644 --- a/code/game/machinery/computer/prisoner.dm +++ b/code/game/machinery/computer/prisoner.dm @@ -94,7 +94,8 @@ usr << "Unauthorized Access." else if(href_list["warn"]) - var/warning = input(usr,"Message:","Enter your message here!","") + var/warning = copytext(sanitize(input(usr,"Message:","Enter your message here!","")),1,MAX_MESSAGE_LEN) + if(!warning) return var/obj/item/weapon/implant/I = locate(href_list["warn"]) if((I)&&(I.imp_in)) var/mob/living/carbon/R = I.imp_in diff --git a/code/game/machinery/computer/security.dm b/code/game/machinery/computer/security.dm index 0790bc4af8b..2a657a0abc9 100644 --- a/code/game/machinery/computer/security.dm +++ b/code/game/machinery/computer/security.dm @@ -348,7 +348,7 @@ What a mess.*/ if (!( istype(active2, /datum/data/record) )) return var/a2 = active2 - var/t1 = input("Add Comment:", "Secure. records", null, null) as message + var/t1 = copytext(sanitize(input("Add Comment:", "Secure. records", null, null) as message),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || active2 != a2)) return var/counter = 1 @@ -415,13 +415,13 @@ What a mess.*/ active1.fields["name"] = t1 if("id") if (istype(active2, /datum/data/record)) - var/t1 = input("Please input id:", "Secure. records", active1.fields["id"], null) as text + var/t1 = copytext(sanitize(input("Please input id:", "Secure. records", active1.fields["id"], null) as text),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || active1 != a1)) return active1.fields["id"] = t1 if("fingerprint") if (istype(active1, /datum/data/record)) - var/t1 = input("Please input fingerprint hash:", "Secure. records", active1.fields["fingerprint"], null) as text + var/t1 = copytext(sanitize(input("Please input fingerprint hash:", "Secure. records", active1.fields["fingerprint"], null) as text),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || active1 != a1)) return active1.fields["fingerprint"] = t1 @@ -433,37 +433,37 @@ What a mess.*/ active1.fields["sex"] = "Male" if("age") if (istype(active1, /datum/data/record)) - var/t1 = input("Please input age:", "Secure. records", active1.fields["age"], null) as text + var/t1 = input("Please input age:", "Secure. records", active1.fields["age"], null) as num if ((!( t1 ) || !( authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || active1 != a1)) return active1.fields["age"] = t1 if("mi_crim") if (istype(active2, /datum/data/record)) - var/t1 = input("Please input minor disabilities list:", "Secure. records", active2.fields["mi_crim"], null) as text + var/t1 = copytext(sanitize(input("Please input minor disabilities list:", "Secure. records", active2.fields["mi_crim"], null) as text),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || active2 != a2)) return active2.fields["mi_crim"] = t1 if("mi_crim_d") if (istype(active2, /datum/data/record)) - var/t1 = input("Please summarize minor dis.:", "Secure. records", active2.fields["mi_crim_d"], null) as message + var/t1 = copytext(sanitize(input("Please summarize minor dis.:", "Secure. records", active2.fields["mi_crim_d"], null) as message),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || active2 != a2)) return active2.fields["mi_crim_d"] = t1 if("ma_crim") if (istype(active2, /datum/data/record)) - var/t1 = input("Please input major diabilities list:", "Secure. records", active2.fields["ma_crim"], null) as text + var/t1 = copytext(sanitize(input("Please input major diabilities list:", "Secure. records", active2.fields["ma_crim"], null) as text),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || active2 != a2)) return active2.fields["ma_crim"] = t1 if("ma_crim_d") if (istype(active2, /datum/data/record)) - var/t1 = input("Please summarize major dis.:", "Secure. records", active2.fields["ma_crim_d"], null) as message + var/t1 = copytext(sanitize(input("Please summarize major dis.:", "Secure. records", active2.fields["ma_crim_d"], null) as message),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || active2 != a2)) return active2.fields["ma_crim_d"] = t1 if("notes") if (istype(active2, /datum/data/record)) - var/t1 = input("Please summarize notes:", "Secure. records", active2.fields["notes"], null) as message + var/t1 = copytext(sanitize(input("Please summarize notes:", "Secure. records", active2.fields["notes"], null) as message),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || active2 != a2)) return active2.fields["notes"] = t1 diff --git a/code/game/machinery/magnet.dm b/code/game/machinery/magnet.dm index 46385e4686a..f7dd8539ad8 100644 --- a/code/game/machinery/magnet.dm +++ b/code/game/machinery/magnet.dm @@ -323,7 +323,7 @@ if(speed <= 0) speed = 1 if("setpath") - var/newpath = input(usr, "Please define a new path!",,path) as text|null + var/newpath = copytext(sanitize(input(usr, "Please define a new path!",,path) as text|null),1,MAX_MESSAGE_LEN) if(newpath && newpath != "") moving = 0 // stop moving path = newpath diff --git a/code/game/machinery/navbeacon.dm b/code/game/machinery/navbeacon.dm index 88711376da9..fe89e8309ae 100644 --- a/code/game/machinery/navbeacon.dm +++ b/code/game/machinery/navbeacon.dm @@ -193,7 +193,7 @@ Transponder Codes: