cyberpresidentvanellope/Paradise
1
0
Fork 0
mirror of https://github.com/ParadiseSS13/Paradise.git synced 2026-08-30 15:37:36 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #179 from Walter0o/patch-2

Browse Source 
Fixes a critical exploit with the autolathe.
This commit is contained in:
ZomgPonies
2014-04-14 08:39:00 -04:00
parent 01b7f673c2 dad64c9f90
commit 73d60d0625
1 changed files with 34 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/game/machinery/autolathe.dm
+34 -1
View File
@@ -275,9 +275,42 @@ var/global/list/autolathe_recipes_hidden = list( \
if (!busy)
if(href_list["make"])
var/turf/T = get_step(src.loc, get_dir(src,usr))
var/obj/template = locate(href_list["make"])
// critical exploit fix start -walter0o
var/obj/item/template = null
var/attempting_to_build = locate(href_list["make"])
if(!attempting_to_build)
return
if(locate(attempting_to_build, src.L) || locate(attempting_to_build, src.LL)) // see if the requested object is in one of the construction lists, if so, it is legit -walter0o
template = attempting_to_build
else // somebody is trying to exploit, alert admins -walter0o
var/turf/LOC = get_turf(usr)
message_admins("[key_name_admin(usr)] tried to exploit an autolathe to duplicate <a href='?_src_=vars;Vars=\ref[attempting_to_build]'>[attempting_to_build]</a> ! ([LOC ? "<a href='?_src_=holder;adminplayerobservecoodjump=1;X=[LOC.x];Y=[LOC.y];Z=[LOC.z]'>JMP</a>" : "null"])", 0)
log_admin("EXPLOIT : [key_name(usr)] tried to exploit an autolathe to duplicate [attempting_to_build] !")
return
// now check for legit multiplier, also only stacks should pass with one to prevent raw-materials-manipulation -walter0o
var/multiplier = text2num(href_list["multiplier"])
if (!multiplier) multiplier = 1
var/max_multiplier = 1
if(istype(template, /obj/item/stack)) // stacks are the only items which can have a multiplier higher than 1 -walter0o
var/obj/item/stack/S = template
max_multiplier = min(S.max_amount, S.m_amt?round(m_amount/S.m_amt):INFINITY, S.g_amt?round(g_amount/S.g_amt):INFINITY) // pasta from regular_win() to make sure the numbers match -walter0o
if( (multiplier > max_multiplier) || (multiplier <= 0) ) // somebody is trying to exploit, alert admins-walter0o
var/turf/LOC = get_turf(usr)
message_admins("[key_name_admin(usr)] tried to exploit an autolathe with multiplier set to <u>[multiplier]</u> on <u>[template]</u> ! ([LOC ? "<a href='?_src_=holder;adminplayerobservecoodjump=1;X=[LOC.x];Y=[LOC.y];Z=[LOC.z]'>JMP</a>" : "null"])" , 0)
log_admin("EXPLOIT : [key_name(usr)] tried to exploit an autolathe with multiplier set to [multiplier] on [template] !")
return
var/power = max(2000, (template.m_amt+template.g_amt+template.f_amt)*multiplier/5)
if(src.m_amount >= template.m_amt*multiplier && src.g_amount >= template.g_amt*multiplier && src.f_amount >= template.f_amt*multiplier)
busy = 1