cyberpresidentvanellope/Paradise
1
0
Fork 0
mirror of https://github.com/ParadiseSS13/Paradise.git synced 2026-07-20 19:44:09 +01:00
Code Issues Packages Projects Releases Wiki Activity

TG: Sanitized a large number of input()s.

Browse Source 
- Hopefully this will cut down on the server spamming/crashing escapades
happening on other servers. (This wont stop that from happening, this just makes
it less severe)
- Some of the sanitizes were probably unnecessary, but better safe then sorry.

Added MAX_NAME_LEN constant which is initialized to 26.
- Please use MAX_NAME_LEN instead of typing in 26 when cutting inputs short.
26's are annoying when they have to be changed and you have to hunt through over
a hundred files and tens of thousands of lines of code to find them all.

Moved uplink_kits.dm to code/game/objects/storage

Moved uplinks.dm to code/game/objects
- The stuff inside uplinks.dm could really be chopped up and split into separate
dm files but this will do for now.

*********************************************************
**********************Important**************************
*********************************************************
When you create code that asks the user for an input consider whether or not it
gets shown to the user through html or the like.

If it does please sanatize() or strip_html() it. Also use copytext() to cutoff
spam by using MAX_NAME_LEN and MAX_MESSAGE_LEN as the cutoff var.
Revision: r3652
Author: 	 johnsonmt88
This commit is contained in:
Erthilo
2012-05-26 00:09:56 +01:00
parent ca62d85b83
commit 6e289dabfc
40 changed files with 627 additions and 164 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/admin/admin.dm
+2 -3
View File
@@ -968,11 +968,10 @@ var/global/BSACooldown = 0
if ((src.rank in list( "Trial Admin", "Badmin", "Game Admin", "Game Master" )))
var/mob/M = locate(href_list["forcespeech"])
if (ismob(M))
var/speech = input("What will [key_name(M)] say?.", "Force speech", "")
var/speech = copytext(sanitize(input("What will [key_name(M)] say?.", "Force speech", "")),1,MAX_MESSAGE_LEN)
if(!speech)
return
M.say(speech)
speech = copytext(sanitize(speech), 1, MAX_MESSAGE_LEN)
log_admin("[key_name(usr)] forced [key_name(M)] to say: [speech]")
message_admins("\blue [key_name_admin(usr)] forced [key_name_admin(M)] to say: [speech]")
else
@@ -1883,7 +1882,7 @@ var/global/BSACooldown = 0
if(!ticker)
alert("The game hasn't started yet!")
return
var/objective = input("Enter an objective")
var/objective = copytext(sanitize(input("Enter an objective")),1,MAX_MESSAGE_LEN)
if(!objective)
return
//feedback_inc("admin_secrets_fun_used",1)
code/modules/admin/verbs/striketeam.dm
+1 -1
View File
@@ -24,7 +24,7 @@ var/global/sent_strike_team = 0
var/input = null
while(!input)
input = input(src, "Please specify which mission the death commando squad shall undertake.", "Specify Mission", "") as text|null
input = copytext(sanitize(input(src, "Please specify which mission the death commando squad shall undertake.", "Specify Mission", "")),1,MAX_MESSAGE_LEN)
if(!input)
if(alert("Error, no mission set. Do you want to exit the setup process?",,"Yes","No")=="Yes")
return
code/modules/admin/verbs/striketeam_syndicate.dm
+1 -1
View File
@@ -24,7 +24,7 @@ var/global/sent_syndicate_strike_team = 0
var/input = null
while(!input)
input = input(src, "Please specify which mission the syndicate strike team shall undertake.", "Specify Mission", "")
input = copytext(sanitize(input(src, "Please specify which mission the syndicate strike team shall undertake.", "Specify Mission", "")),1,MAX_MESSAGE_LEN)
if(!input)
if(alert("Error, no mission set. Do you want to exit the setup process?",,"Yes","No")=="Yes")
return
code/modules/mob/living/carbon/human/emote.dm
+1 -1
View File
@@ -76,7 +76,7 @@
param = trim(param)
var/input
if(!param)
input = input("Choose an emote to display.") as text|null
input = copytext(sanitize(input("Choose an emote to display.") as text|null),1,MAX_MESSAGE_LEN)
else
input = param
if(input)
code/modules/mob/living/silicon/robot/emote.dm
+1 -2
View File
@@ -54,10 +54,9 @@
m_type = 2
if ("custom")
var/input = input("Choose an emote to display.") as text|null
var/input = copytext(sanitize(input("Choose an emote to display.") as text|null),1,MAX_MESSAGE_LEN)
if (!input)
return
input = sanitize(input)
var/input2 = input("Is this a visible or hearable emote?") in list("Visible","Hearable")
if (input2 == "Visible")
m_type = 1
code/modules/mob/new_player/preferences.dm
+8 -18
View File
@@ -633,16 +633,15 @@ datum/preferences
switch(link_tags["real_name"])
if("input")
new_name = input(user, "Please select a name:", "Character Generation") as text
new_name = copytext( (input(user, "Please select a name:", "Character Generation") as text) ,1,MAX_NAME_LEN)
var/list/bad_characters = list("_", "'", "\"", "<", ">", ";", "\[", "\]", "{", "}", "|", "\\","0","1","2","3","4","5","6","7","8","9")
for(var/c in bad_characters)
new_name = dd_replacetext(new_name, c, "")
if(!new_name || (new_name == "Unknown") || (new_name == "floor") || (new_name == "wall") || (new_name == "r-wall"))
alert("Invalid name. Don't do that!")
return
if(length(new_name) >= 26)
alert("That name is too long.")
return
//Make it so number one. (means you can have names like McMillian). Credit to: Jtgibson
new_name = simple_titlecase(new_name)
/*
@@ -660,8 +659,6 @@ datum/preferences
randomize_name()
if(new_name)
if(length(new_name) >= 26)
new_name = copytext(new_name, 1, 26)
real_name = new_name
if(link_tags["age"])
@@ -675,17 +672,9 @@ datum/preferences
if(link_tags["OOC"])
var/tempnote = ""
tempnote = input(user, "Please enter your OOC Notes!:", "OOC notes" , metadata) as text
var/list/bad_characters = list("_", "\"", "<", ">", ";", "\[", "\]", "{", "}", "|", "\\","0","1","2","3","4","5","6","7","8","9")
for(var/c in bad_characters)
tempnote = dd_replacetext(tempnote, c, "")
if(length(tempnote) >= 255)
alert("That name is too long. (255 character max, please)")
return
metadata = tempnote
tempnote = copytext(sanitize(input(user, "Please enter your OOC Notes!:", "OOC notes" , metadata) as text),1,MAX_MESSAGE_LEN)
if(tempnote)
metadata = tempnote
return
@@ -757,7 +746,7 @@ datum/preferences
if("random")
randomize_skin_tone()
if("input")
var/new_tone = input(user, "Please select skin tone level: 1-220 (1=albino, 35=caucasian, 150=black, 220='very' black) or 20-70 for Tajarans", "Character Generation") as text
var/new_tone = input(user, "Please select skin tone level: 1-220 (1=albino, 35=caucasian, 150=black, 220='very' black) or 20-70 for Tajarans", "Character Generation") as num
if(new_tone)
if(species == "Tajaran")
s_tone = max(min(round(text2num(new_tone)), 70), 20)
@@ -769,6 +758,7 @@ datum/preferences
if(species != "Human")
return
switch(link_tags["h_style"])
// New and improved hair selection code, by Doohl
if("random") // random hair selection
code/modules/paperwork/folders.dm
+1 -2
View File
@@ -35,8 +35,7 @@
user << "\blue You put the [W] into the folder."
update_icon()
else if(istype(W, /obj/item/weapon/pen))
var/n_name = input(usr, "What would you like to label the folder?", "Folder Labelling", null) as text
n_name = copytext(n_name, 1, 32)
var/n_name = copytext(sanitize(input(usr, "What would you like to label the folder?", "Folder Labelling", null) as text),1,MAX_NAME_LEN)
if ((loc == usr && usr.stat == 0))
name = "folder[(n_name ? text("- '[n_name]'") : null)]"
return
code/modules/paperwork/handlabeler.dm
+1 -4
View File
@@ -40,13 +40,10 @@
if(mode)
usr << "\blue You turn on the hand labeler."
//Now let them chose the text.
var/str = reject_bad_text(input(usr,"Label text?","Set label","")) //sanitize stuff! GOD DAMN THIS IS A SECURITY HOLE
var/str = copytext(reject_bad_text(input(usr,"Label text?","Set label","")),1,MAX_NAME_LEN)
if(!str || !length(str))
usr << "\red Invalid text."
return
if(length(str) > 64)
usr << "\red Text too long."
return
label = str
usr << "\blue You set the text to '[str]'."
else
code/modules/paperwork/paper.dm
+1 -1
View File
@@ -62,7 +62,7 @@
if ((usr.mutations & CLUMSY) && prob(50))
usr << "\red You cut yourself on the paper."
return
var/n_name = input(usr, "What would you like to label the paper?", "Paper Labelling", null) as text
var/n_name = copytext(sanitize(input(usr, "What would you like to label the paper?", "Paper Labelling", null) as text),1,MAX_NAME_LEN)
n_name = copytext(n_name, 1, 32)
if ((loc == usr && usr.stat == 0))
name = "paper[(n_name ? text("- '[n_name]'") : null)]"
code/modules/projectiles/guns/projectile/revolver.dm
+1 -2
View File
@@ -27,8 +27,7 @@
M << "\red You don't feel cool enough to name this gun, chump."
return 0
var/input = input("What do you want to name the gun?",,"")
input = sanitize(input)
var/input = copytext(sanitize(input("What do you want to name the gun?",,"")),1,MAX_NAME_LEN)
if(src && input && !M.stat && in_range(M,src))
name = input
code/modules/recycling/sortingmachinery.dm
+8 -22
View File
@@ -52,26 +52,19 @@
else if(istype(W, /obj/item/weapon/pen))
switch(alert("What would you like to alter?",,"Title","Description", "Cancel"))
if("Title")
var/str = input(usr,"Label text?","Set label","")
var/str = copytext(sanitize(input(usr,"Label text?","Set label","")),1,MAX_NAME_LEN)
if(!str || !length(str))
usr << "\red Invalid text."
return
if(length(str) > 64)
usr << "\red Text too long."
return
var/label = str
for(var/mob/M in viewers())
M << "\blue [user] labels [src] as [label]."
src.name = "[src.name] ([label])"
M << "\blue [user] labels [src] as [str]."
src.name = "[src.name] ([str])"
update_icon()
if("Description")
var/str = input(usr,"Label text?","Set label","")
var/str = copytext(sanitize(input(usr,"Label text?","Set label","")),1,MAX_NAME_LEN)
if(!str || !length(str))
usr << "\red Invalid text."
return
if(length(str) > 64)
usr << "\red Text too long."
return
examtext = str
for(var/mob/M in viewers())
M << "\blue [user] labels [src] with the note: [examtext]."
@@ -128,26 +121,19 @@
else if(istype(W, /obj/item/weapon/pen))
switch(alert("What would you like to alter?",,"Title","Description", "Cancel"))
if("Title")
var/str = input(usr,"Label text?","Set label","")
var/str = copytext(sanitize(input(usr,"Label text?","Set label","")),1,MAX_NAME_LEN)
if(!str || !length(str))
usr << "\red Invalid text."
return
if(length(str) > 64)
usr << "\red Text too long."
return
var/label = str
for(var/mob/M in viewers())
M << "\blue [user] labels [src] as [label]."
src.name = "[src.name] ([label])"
M << "\blue [user] labels [src] as [str]."
src.name = "[src.name] ([str])"
update_icon()
if("Description")
var/str = input(usr,"Label text?","Set label","")
var/str = copytext(sanitize(input(usr,"Label text?","Set label","")),1,MAX_NAME_LEN)
if(!str || !length(str))
usr << "\red Invalid text."
return
if(length(str) > 64)
usr << "\red Text too long."
return
examtext = str
for(var/mob/M in viewers())
M << "\blue [user] labels [src] with the note: [examtext]."