From fd529891caa22eb534042b93a16afbd2a167aa36 Mon Sep 17 00:00:00 2001 From: "johnsonmt88@gmail.com" Date: Thu, 24 May 2012 19:34:04 +0000 Subject: [PATCH] Sanitized a large number of input()s. - Hopefully this will cut down on the server spamming/crashing escapades happening on other servers. (This wont stop that from happening, this just makes it less severe) - Some of the sanitizes were probably unnecessary, but better safe then sorry. Added MAX_NAME_LEN constant which is initialized to 26. - Please use MAX_NAME_LEN instead of typing in 26 when cutting inputs short. 26's are annoying when they have to be changed and you have to hunt through over a hundred files and tens of thousands of lines of code to find them all. Moved uplink_kits.dm to code/game/objects/storage Moved uplinks.dm to code/game/objects - The stuff inside uplinks.dm could really be chopped up and split into separate dm files but this will do for now. ********************************************************* **********************Important************************** ********************************************************* When you create code that asks the user for an input consider whether or not it gets shown to the user through html or the like. If it does please sanatize() or strip_html() it. Also use copytext() to cutoff spam by using MAX_NAME_LEN and MAX_MESSAGE_LEN as the cutoff var. git-svn-id: http://tgstation13.googlecode.com/svn/trunk@3652 316c924e-a436-60f5-8080-3fe189b3f50e --- code/datums/datumvars.dm | 2 +- code/datums/mind.dm | 4 +- code/defines/global.dm | 1 + code/defines/procs/helpers.dm | 18 +- code/game/gamemodes/events/space_ninja.dm | 2 +- code/game/gamemodes/nuclear/nuclear.dm | 11 +- code/game/gamemodes/objective.dm | 2 +- code/game/gamemodes/wizard/wizard.dm | 8 +- code/game/jobs/job/civilian_chaplain.dm | 13 +- code/game/machinery/bots/mulebot.dm | 2 +- .../game/machinery/computer/communications.dm | 6 +- code/game/machinery/computer/medical.dm | 26 +- code/game/machinery/computer/prisoner.dm | 3 +- code/game/machinery/computer/security.dm | 18 +- code/game/machinery/magnet.dm | 2 +- code/game/machinery/navbeacon.dm | 2 +- code/game/machinery/requests_console.dm | 4 +- .../telecomms/machine_interactions.dm | 2 +- code/game/magic/cultist/runes.dm | 2 +- code/game/magic/library.dm | 16 +- code/game/objects/devices/paicard.dm | 2 +- code/game/objects/items/robot_parts.dm | 2 +- code/game/objects/items/weapons/AI_modules.dm | 20 +- code/game/objects/items/weapons/explosives.dm | 4 +- .../objects/items/weapons/wrappingpaper.dm | 3 +- code/game/objects/storage/uplink_kits.dm | 53 ++ code/game/objects/uplinks.dm | 467 ++++++++++++++++++ code/game/supplyshuttle.dm | 8 +- code/modules/admin/admin.dm | 5 +- code/modules/admin/verbs/striketeam.dm | 2 +- .../admin/verbs/striketeam_syndicate.dm | 2 +- code/modules/mob/living/carbon/human/emote.dm | 3 +- .../modules/mob/living/silicon/robot/emote.dm | 3 +- code/modules/mob/new_player/preferences.dm | 26 +- code/modules/paperwork/folders.dm | 3 +- code/modules/paperwork/handlabeler.dm | 5 +- code/modules/paperwork/paper.dm | 3 +- .../projectiles/guns/projectile/revolver.dm | 3 +- code/modules/recycling/sortingmachinery.dm | 20 +- tgstation.dme | 5 +- 40 files changed, 627 insertions(+), 156 deletions(-) create mode 100644 code/game/objects/storage/uplink_kits.dm create mode 100644 code/game/objects/uplinks.dm diff --git a/code/datums/datumvars.dm b/code/datums/datumvars.dm index 5aab3c5abc4..c162bf66724 100644 --- a/code/datums/datumvars.dm +++ b/code/datums/datumvars.dm @@ -415,7 +415,7 @@ client/Topic(href, href_list, hsrc) //~CARN: for renaming mobs (updates their real_name and their ID/PDA if applicable). else if (href_list["rename"]) - var/new_name = input(usr,"What would you like to name this mob?","Input a name") as text|null + var/new_name = copytext(sanitize(input(usr,"What would you like to name this mob?","Input a name") as text|null),1,MAX_NAME_LEN) if(!new_name) return var/mob/M = locate(href_list["rename"]) if(!istype(M)) return diff --git a/code/datums/mind.dm b/code/datums/mind.dm index d41acc78e51..1a2fc842495 100644 --- a/code/datums/mind.dm +++ b/code/datums/mind.dm @@ -292,7 +292,7 @@ datum/mind assigned_role = new_role else if (href_list["memory_edit"]) - var/new_memo = input("Write new memory", "Memory", memory) as null|message + var/new_memo = copytext(sanitize(input("Write new memory", "Memory", memory) as null|message),1,MAX_MESSAGE_LEN) if (isnull(new_memo)) return memory = new_memo @@ -399,7 +399,7 @@ datum/mind new_objective.target_amount = target_number if ("custom") - var/expl = input("Custom objective:", "Objective", objective ? objective.explanation_text : "") as text|null + var/expl = copytext(sanitize(input("Custom objective:", "Objective", objective ? objective.explanation_text : "") as text|null),1,MAX_MESSAGE_LEN) if (!expl) return new_objective = new /datum/objective new_objective.owner = src diff --git a/code/defines/global.dm b/code/defines/global.dm index ad0687c0529..83d2197b158 100644 --- a/code/defines/global.dm +++ b/code/defines/global.dm @@ -164,6 +164,7 @@ var //Don't set this very much higher then 1024 unless you like inviting people in to dos your server with message spam const/MAX_MESSAGE_LEN = 1024 + const/MAX_NAME_LEN = 26 const/shuttle_time_in_station = 1800 // 3 minutes in the station const/shuttle_time_to_arrive = 6000 // 10 minutes to arrive diff --git a/code/defines/procs/helpers.dm b/code/defines/procs/helpers.dm index 62528d674a6..3008da93100 100644 --- a/code/defines/procs/helpers.dm +++ b/code/defines/procs/helpers.dm @@ -681,15 +681,15 @@ Turf and target are seperate in case you want to teleport some distance from a t /proc/ainame(var/mob/M as mob) var/randomname = M.name var/time_passed = world.time//Pretty basic but it'll do. It's still possible to bypass this by return ainame(). - var/newname = input(M,"You are the AI. Would you like to change your name to something else?", "Name change",randomname) + var/newname = copytext(sanitize(input(M,"You are the AI. Would you like to change your name to something else?", "Name change",randomname)),1,MAX_NAME_LEN) if((world.time-time_passed)>200)//If more than 20 game seconds passed. M << "You took too long to decide. Default name selected." return - if (length(newname) == 0) + if (!newname) newname = randomname - if (newname) + else if (newname == "Inactive AI")//Keeping this here to prevent dumb. M << "That name is reserved." return ainame(M) @@ -697,22 +697,19 @@ Turf and target are seperate in case you want to teleport some distance from a t if (A.real_name == newname&&newname!=randomname) M << "There's already an AI with that name." return ainame(M) - if (length(newname) >= 26) - newname = copytext(newname, 1, 26) - newname = dd_replacetext(newname, ">", "'") M.real_name = newname M.name = newname M.original_name = newname /proc/clname(var/mob/M as mob) //--All praise goes to NEO|Phyte, all blame goes to DH, and it was Cindi-Kate's idea var/randomname = pick(clown_names) - var/newname = input(M,"You are the clown. Would you like to change your name to something else?", "Name change",randomname) + var/newname = copytext(sanitize(input(M,"You are the clown. Would you like to change your name to something else?", "Name change",randomname)),1,MAX_NAME_LEN) var/oldname = M.real_name - if (length(newname) == 0) + if (!newname) newname = randomname - if (newname) + else var/badname = 0 switch(newname) if("Unknown") badname = 1 @@ -729,9 +726,6 @@ Turf and target are seperate in case you want to teleport some distance from a t if(A.real_name == newname) M << "That name is reserved." return clname(M) - if(length(newname) >= 26) - newname = copytext(newname, 1, 26) - newname = dd_replacetext(newname, ">", "'") M.real_name = newname M.name = newname M.original_name = newname diff --git a/code/game/gamemodes/events/space_ninja.dm b/code/game/gamemodes/events/space_ninja.dm index de354bd3d56..d47dec3dd55 100644 --- a/code/game/gamemodes/events/space_ninja.dm +++ b/code/game/gamemodes/events/space_ninja.dm @@ -410,7 +410,7 @@ As such, it's hard-coded for now. No reason for it not to be, really. var/mission while(!mission) - mission = input(src, "Please specify which mission the space ninja shall undertake.", "Specify Mission", "") + mission = copytext(sanitize(input(src, "Please specify which mission the space ninja shall undertake.", "Specify Mission", "")),1,MAX_MESSAGE_LEN) if(!mission) if(alert("Error, no mission set. Do you want to exit the setup process?",,"Yes","No")=="Yes") return diff --git a/code/game/gamemodes/nuclear/nuclear.dm b/code/game/gamemodes/nuclear/nuclear.dm index be3007195a3..397477f8d42 100644 --- a/code/game/gamemodes/nuclear/nuclear.dm +++ b/code/game/gamemodes/nuclear/nuclear.dm @@ -333,18 +333,15 @@ /proc/nukelastname(var/mob/M as mob) //--All praise goes to NEO|Phyte, all blame goes to DH, and it was Cindi-Kate's idea. Also praise Urist for copypasta ho. var/randomname = pick(last_names) - var/newname = input(M,"You are the nuke operative [pick("Czar", "Boss", "Commander", "Chief", "Kingpin", "Director", "Overlord")]. Please choose a last name for your family.", "Name change",randomname) + var/newname = copytext(sanitize(input(M,"You are the nuke operative [pick("Czar", "Boss", "Commander", "Chief", "Kingpin", "Director", "Overlord")]. Please choose a last name for your family.", "Name change",randomname)),1,MAX_NAME_LEN) - if (length(newname) == 0) + if (!newname) newname = randomname - if (newname) - if (newname == "Unknown") + else + if (newname == "Unknown" || newname == "floor" || newname == "wall" || newname == "rwall" || newname == "_") M << "That name is reserved." return nukelastname(M) - if (length(newname) >= 26) - newname = copytext(newname, 1, 26) - newname = dd_replacetext(newname, ">", "'") return newname diff --git a/code/game/gamemodes/objective.dm b/code/game/gamemodes/objective.dm index 488825a3917..2898de8f41d 100644 --- a/code/game/gamemodes/objective.dm +++ b/code/game/gamemodes/objective.dm @@ -338,7 +338,7 @@ datum/objective/steal var/tmp_obj = new custom_target var/custom_name = tmp_obj:name del(tmp_obj) - custom_name = input("Enter target name:", "Objective target", custom_name) as text|null + custom_name = copytext(sanitize(input("Enter target name:", "Objective target", custom_name) as text|null),1,MAX_MESSAGE_LEN) if (!custom_name) return target_name = custom_name steal_target = custom_target diff --git a/code/game/gamemodes/wizard/wizard.dm b/code/game/gamemodes/wizard/wizard.dm index 3c7f6247b15..b7c986e0ec1 100644 --- a/code/game/gamemodes/wizard/wizard.dm +++ b/code/game/gamemodes/wizard/wizard.dm @@ -116,15 +116,11 @@ var/wizard_name_second = pick(wizard_second) var/randomname = "[wizard_name_first] [wizard_name_second]" spawn(0) - var/newname = input(wizard_mob, "You are the Space Wizard. Would you like to change your name to something else?", "Name change", randomname) as null|text + var/newname = copytext(sanitize(input(wizard_mob, "You are the Space Wizard. Would you like to change your name to something else?", "Name change", randomname) as null|text),1,MAX_NAME_LEN) - if (length(newname) == 0) + if (!newname) newname = randomname - if (newname) - if (length(newname) >= 26) - newname = copytext(newname, 1, 26) - newname = dd_replacetext(newname, ">", "'") wizard_mob.real_name = newname wizard_mob.name = newname return diff --git a/code/game/jobs/job/civilian_chaplain.dm b/code/game/jobs/job/civilian_chaplain.dm index 5b0d5a04b05..be8c830895c 100644 --- a/code/game/jobs/job/civilian_chaplain.dm +++ b/code/game/jobs/job/civilian_chaplain.dm @@ -20,15 +20,11 @@ H.equip_if_possible(new /obj/item/clothing/shoes/black(H), H.slot_shoes) spawn(0) var/religion_name = "Christianity" - var/new_religion = input(H, "You are the Chaplain. Would you like to change your religion? Default is Christianity, in SPACE.", "Name change", religion_name) + var/new_religion = copytext(sanitize(input(H, "You are the Chaplain. Would you like to change your religion? Default is Christianity, in SPACE.", "Name change", religion_name)),1,MAX_NAME_LEN) if ((length(new_religion) == 0) || (new_religion == "Christianity")) new_religion = religion_name - if (new_religion) - if (length(new_religion) >= 26) - new_religion = copytext(new_religion, 1, 26) - new_religion = dd_replacetext(new_religion, ">", "'") switch(lowertext(new_religion)) if("christianity") B.name = pick("The Holy Bible","The Dead Sea Scrolls") @@ -59,15 +55,10 @@ spawn(1) var/deity_name = "Space Jesus" - var/new_deity = input(H, "Would you like to change your deity? Default is Space Jesus.", "Name change", deity_name) + var/new_deity = copytext(sanitize(input(H, "Would you like to change your deity? Default is Space Jesus.", "Name change", deity_name)),1,MAX_NAME_LEN) if ((length(new_deity) == 0) || (new_deity == "Space Jesus") ) new_deity = deity_name - - if(new_deity) - if (length(new_deity) >= 26) - new_deity = copytext(new_deity, 1, 26) - new_deity = dd_replacetext(new_deity, ">", "'") B.deity_name = new_deity var/accepted = 0 diff --git a/code/game/machinery/bots/mulebot.dm b/code/game/machinery/bots/mulebot.dm index 0db85a21b42..348710f1d29 100644 --- a/code/game/machinery/bots/mulebot.dm +++ b/code/game/machinery/bots/mulebot.dm @@ -372,7 +372,7 @@ if("setid") refresh=0 - var/new_id = input("Enter new bot ID", "Mulebot [suffix ? "([suffix])" : ""]", suffix) as text|null + var/new_id = copytext(sanitize(input("Enter new bot ID", "Mulebot [suffix ? "([suffix])" : ""]", suffix) as text|null),1,MAX_NAME_LEN) refresh=1 if(new_id) suffix = new_id diff --git a/code/game/machinery/computer/communications.dm b/code/game/machinery/computer/communications.dm index f18014c282a..bec9773a9e9 100644 --- a/code/game/machinery/computer/communications.dm +++ b/code/game/machinery/computer/communications.dm @@ -97,7 +97,7 @@ if("announce") if(src.authenticated==2) if(message_cooldown) return - var/input = input(usr, "Please choose a message to announce to the station crew.", "What?", "") + var/input = copytext(sanitize(input(usr, "Please choose a message to announce to the station crew.", "What?", "")),1,MAX_MESSAGE_LEN) if(!input || !(usr in view(1,src))) return captain_announce(input)//This should really tell who is, IE HoP, CE, HoS, RD, Captain @@ -176,7 +176,7 @@ if(centcomm_message_cooldown) usr << "Arrays recycling. Please stand by." return - var/input = input(usr, "Please choose a message to transmit to Centcomm via quantum entanglement. Please be aware that this process is very expensive, and abuse will lead to... termination. Transmission does not guarantee a response.", "To abort, send an empty message.", "") + var/input = copytext(sanitize(input(usr, "Please choose a message to transmit to Centcomm via quantum entanglement. Please be aware that this process is very expensive, and abuse will lead to... termination. Transmission does not guarantee a response.", "To abort, send an empty message.", "")),1,MAX_MESSAGE_LEN) if(!input || !(usr in view(1,src))) return Centcomm_announce(input, usr) @@ -193,7 +193,7 @@ if(centcomm_message_cooldown) usr << "Arrays recycling. Please stand by." return - var/input = input(usr, "Please choose a message to transmit to \[ABNORMAL ROUTING CORDINATES\] via quantum entanglement. Please be aware that this process is very expensive, and abuse will lead to... termination. Transmission does not guarantee a response.", "To abort, send an empty message.", "") + var/input = copytext(sanitize(input(usr, "Please choose a message to transmit to \[ABNORMAL ROUTING CORDINATES\] via quantum entanglement. Please be aware that this process is very expensive, and abuse will lead to... termination. Transmission does not guarantee a response.", "To abort, send an empty message.", "")),1,MAX_MESSAGE_LEN) if(!input || !(usr in view(1,src))) return Syndicate_announce(input, usr) diff --git a/code/game/machinery/computer/medical.dm b/code/game/machinery/computer/medical.dm index 212030a3845..f74e6f119a3 100644 --- a/code/game/machinery/computer/medical.dm +++ b/code/game/machinery/computer/medical.dm @@ -183,7 +183,7 @@ switch(href_list["field"]) if("fingerprint") if (istype(src.active1, /datum/data/record)) - var/t1 = input("Please input fingerprint hash:", "Med. records", src.active1.fields["fingerprint"], null) as text + var/t1 = copytext(sanitize(input("Please input fingerprint hash:", "Med. records", src.active1.fields["fingerprint"], null) as text),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active1 != a1)) return src.active1.fields["fingerprint"] = t1 @@ -195,61 +195,61 @@ src.active1.fields["sex"] = "Male" if("age") if (istype(src.active1, /datum/data/record)) - var/t1 = input("Please input age:", "Med. records", src.active1.fields["age"], null) as text + var/t1 = input("Please input age:", "Med. records", src.active1.fields["age"], null) as num if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active1 != a1)) return src.active1.fields["age"] = t1 if("mi_dis") if (istype(src.active2, /datum/data/record)) - var/t1 = input("Please input minor disabilities list:", "Med. records", src.active2.fields["mi_dis"], null) as text + var/t1 = copytext(sanitize(input("Please input minor disabilities list:", "Med. records", src.active2.fields["mi_dis"], null) as text),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active2 != a2)) return src.active2.fields["mi_dis"] = t1 if("mi_dis_d") if (istype(src.active2, /datum/data/record)) - var/t1 = input("Please summarize minor dis.:", "Med. records", src.active2.fields["mi_dis_d"], null) as message + var/t1 = copytext(sanitize(input("Please summarize minor dis.:", "Med. records", src.active2.fields["mi_dis_d"], null) as message),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active2 != a2)) return src.active2.fields["mi_dis_d"] = t1 if("ma_dis") if (istype(src.active2, /datum/data/record)) - var/t1 = input("Please input major diabilities list:", "Med. records", src.active2.fields["ma_dis"], null) as text + var/t1 = copytext(sanitize(input("Please input major diabilities list:", "Med. records", src.active2.fields["ma_dis"], null) as text),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active2 != a2)) return src.active2.fields["ma_dis"] = t1 if("ma_dis_d") if (istype(src.active2, /datum/data/record)) - var/t1 = input("Please summarize major dis.:", "Med. records", src.active2.fields["ma_dis_d"], null) as message + var/t1 = copytext(sanitize(input("Please summarize major dis.:", "Med. records", src.active2.fields["ma_dis_d"], null) as message),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active2 != a2)) return src.active2.fields["ma_dis_d"] = t1 if("alg") if (istype(src.active2, /datum/data/record)) - var/t1 = input("Please state allergies:", "Med. records", src.active2.fields["alg"], null) as text + var/t1 = copytext(sanitize(input("Please state allergies:", "Med. records", src.active2.fields["alg"], null) as text),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active2 != a2)) return src.active2.fields["alg"] = t1 if("alg_d") if (istype(src.active2, /datum/data/record)) - var/t1 = input("Please summarize allergies:", "Med. records", src.active2.fields["alg_d"], null) as message + var/t1 = copytext(sanitize(input("Please summarize allergies:", "Med. records", src.active2.fields["alg_d"], null) as message),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active2 != a2)) return src.active2.fields["alg_d"] = t1 if("cdi") if (istype(src.active2, /datum/data/record)) - var/t1 = input("Please state diseases:", "Med. records", src.active2.fields["cdi"], null) as text + var/t1 = copytext(sanitize(input("Please state diseases:", "Med. records", src.active2.fields["cdi"], null) as text),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active2 != a2)) return src.active2.fields["cdi"] = t1 if("cdi_d") if (istype(src.active2, /datum/data/record)) - var/t1 = input("Please summarize diseases:", "Med. records", src.active2.fields["cdi_d"], null) as message + var/t1 = copytext(sanitize(input("Please summarize diseases:", "Med. records", src.active2.fields["cdi_d"], null) as message),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active2 != a2)) return src.active2.fields["cdi_d"] = t1 if("notes") if (istype(src.active2, /datum/data/record)) - var/t1 = input("Please summarize notes:", "Med. records", src.active2.fields["notes"], null) as message + var/t1 = copytext(sanitize(input("Please summarize notes:", "Med. records", src.active2.fields["notes"], null) as message),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active2 != a2)) return src.active2.fields["notes"] = t1 @@ -264,7 +264,7 @@ src.temp = text("Blood Type:
\n\tA- A+
\n\tB- B+
\n\tAB- AB+
\n\tO- O+
", src, src, src, src, src, src, src, src) if("b_dna") if (istype(src.active1, /datum/data/record)) - var/t1 = input("Please input DNA hash:", "Med. records", src.active1.fields["dna"], null) as text + var/t1 = copytext(sanitize(input("Please input DNA hash:", "Med. records", src.active1.fields["dna"], null) as text),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active1 != a1)) return src.active1.fields["dna"] = t1 @@ -365,7 +365,7 @@ if (!( istype(src.active2, /datum/data/record) )) return var/a2 = src.active2 - var/t1 = input("Add Comment:", "Med. records", null, null) as message + var/t1 = copytext(sanitize(input("Add Comment:", "Med. records", null, null) as message),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( src.authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || src.active2 != a2)) return var/counter = 1 diff --git a/code/game/machinery/computer/prisoner.dm b/code/game/machinery/computer/prisoner.dm index 9863a73256e..adc45dc3748 100644 --- a/code/game/machinery/computer/prisoner.dm +++ b/code/game/machinery/computer/prisoner.dm @@ -94,7 +94,8 @@ usr << "Unauthorized Access." else if(href_list["warn"]) - var/warning = input(usr,"Message:","Enter your message here!","") + var/warning = copytext(sanitize(input(usr,"Message:","Enter your message here!","")),1,MAX_MESSAGE_LEN) + if(!warning) return var/obj/item/weapon/implant/I = locate(href_list["warn"]) if((I)&&(I.imp_in)) var/mob/living/carbon/R = I.imp_in diff --git a/code/game/machinery/computer/security.dm b/code/game/machinery/computer/security.dm index 1f6dab284fd..acff945c5fb 100644 --- a/code/game/machinery/computer/security.dm +++ b/code/game/machinery/computer/security.dm @@ -322,7 +322,7 @@ What a mess.*/ if (!( istype(active2, /datum/data/record) )) return var/a2 = active2 - var/t1 = input("Add Comment:", "Secure. records", null, null) as message + var/t1 = copytext(sanitize(input("Add Comment:", "Secure. records", null, null) as message),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || active2 != a2)) return var/counter = 1 @@ -389,13 +389,13 @@ What a mess.*/ active1.fields["name"] = t1 if("id") if (istype(active2, /datum/data/record)) - var/t1 = input("Please input id:", "Secure. records", active1.fields["id"], null) as text + var/t1 = copytext(sanitize(input("Please input id:", "Secure. records", active1.fields["id"], null) as text),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || active1 != a1)) return active1.fields["id"] = t1 if("fingerprint") if (istype(active1, /datum/data/record)) - var/t1 = input("Please input fingerprint hash:", "Secure. records", active1.fields["fingerprint"], null) as text + var/t1 = copytext(sanitize(input("Please input fingerprint hash:", "Secure. records", active1.fields["fingerprint"], null) as text),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || active1 != a1)) return active1.fields["fingerprint"] = t1 @@ -407,37 +407,37 @@ What a mess.*/ active1.fields["sex"] = "Male" if("age") if (istype(active1, /datum/data/record)) - var/t1 = input("Please input age:", "Secure. records", active1.fields["age"], null) as text + var/t1 = input("Please input age:", "Secure. records", active1.fields["age"], null) as num if ((!( t1 ) || !( authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || active1 != a1)) return active1.fields["age"] = t1 if("mi_crim") if (istype(active2, /datum/data/record)) - var/t1 = input("Please input minor disabilities list:", "Secure. records", active2.fields["mi_crim"], null) as text + var/t1 = copytext(sanitize(input("Please input minor disabilities list:", "Secure. records", active2.fields["mi_crim"], null) as text),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || active2 != a2)) return active2.fields["mi_crim"] = t1 if("mi_crim_d") if (istype(active2, /datum/data/record)) - var/t1 = input("Please summarize minor dis.:", "Secure. records", active2.fields["mi_crim_d"], null) as message + var/t1 = copytext(sanitize(input("Please summarize minor dis.:", "Secure. records", active2.fields["mi_crim_d"], null) as message),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || active2 != a2)) return active2.fields["mi_crim_d"] = t1 if("ma_crim") if (istype(active2, /datum/data/record)) - var/t1 = input("Please input major diabilities list:", "Secure. records", active2.fields["ma_crim"], null) as text + var/t1 = copytext(sanitize(input("Please input major diabilities list:", "Secure. records", active2.fields["ma_crim"], null) as text),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || active2 != a2)) return active2.fields["ma_crim"] = t1 if("ma_crim_d") if (istype(active2, /datum/data/record)) - var/t1 = input("Please summarize major dis.:", "Secure. records", active2.fields["ma_crim_d"], null) as message + var/t1 = copytext(sanitize(input("Please summarize major dis.:", "Secure. records", active2.fields["ma_crim_d"], null) as message),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || active2 != a2)) return active2.fields["ma_crim_d"] = t1 if("notes") if (istype(active2, /datum/data/record)) - var/t1 = input("Please summarize notes:", "Secure. records", active2.fields["notes"], null) as message + var/t1 = copytext(sanitize(input("Please summarize notes:", "Secure. records", active2.fields["notes"], null) as message),1,MAX_MESSAGE_LEN) if ((!( t1 ) || !( authenticated ) || usr.stat || usr.restrained() || (!in_range(src, usr) && (!istype(usr, /mob/living/silicon))) || active2 != a2)) return active2.fields["notes"] = t1 diff --git a/code/game/machinery/magnet.dm b/code/game/machinery/magnet.dm index 46385e4686a..f7dd8539ad8 100644 --- a/code/game/machinery/magnet.dm +++ b/code/game/machinery/magnet.dm @@ -323,7 +323,7 @@ if(speed <= 0) speed = 1 if("setpath") - var/newpath = input(usr, "Please define a new path!",,path) as text|null + var/newpath = copytext(sanitize(input(usr, "Please define a new path!",,path) as text|null),1,MAX_MESSAGE_LEN) if(newpath && newpath != "") moving = 0 // stop moving path = newpath diff --git a/code/game/machinery/navbeacon.dm b/code/game/machinery/navbeacon.dm index 88711376da9..fe89e8309ae 100644 --- a/code/game/machinery/navbeacon.dm +++ b/code/game/machinery/navbeacon.dm @@ -193,7 +193,7 @@ Transponder Codes: