cyberpresidentvanellope/Polaris
1
0
Fork 0
mirror of https://github.com/PolarisSS13/Polaris.git synced 2026-08-25 06:06:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

Updates text sanitization (#9082)

Browse Source
This commit is contained in:
Varlaisvea
2023-05-28 11:06:15 -08:00
committed by GitHub
parent 7532593f15
commit 06338d2a95
8 changed files with 35 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/client/preference_setup/antagonism/01_basic.dm
+3 -3
View File
@@ -44,11 +44,11 @@ var/global/list/uplink_locations = list("PDA", "Headset", "None")
return TOPIC_REFRESH
if(href_list["exploitable_record"])
var/exploitmsg = sanitize(input(user,"Set exploitable information about you here.","Exploitable Information", html_decode(pref.exploit_record)) as message|null, MAX_RECORD_LENGTH, extra = 0)
var/exploitmsg = html_decode(sanitizeSafe(input(user,"Set exploitable information about you here.","Exploitable Information", html_decode(pref.exploit_record)) as message|null, MAX_RECORD_LENGTH, extra = 0))
if(!isnull(exploitmsg) && !jobban_isbanned(user, "Records") && CanUseTopic(user))
pref.exploit_record = exploitmsg
return TOPIC_REFRESH
if(href_list["antagfaction"])
var/choice = input(user, "Please choose an antagonistic faction to work for.", "Character Preference", pref.antag_faction) as null|anything in antag_faction_choices + list("None","Other")
if(!choice || !CanUseTopic(user))
@@ -60,7 +60,7 @@ var/global/list/uplink_locations = list("PDA", "Headset", "None")
else
pref.antag_faction = choice
return TOPIC_REFRESH
if(href_list["antagvis"])
var/choice = input(user, "Please choose an antagonistic visibility level.", "Character Preference", pref.antag_vis) as null|anything in antag_visiblity_choices
if(!choice || !CanUseTopic(user))
code/modules/client/preference_setup/general/05_background.dm
+7 -7
View File
@@ -107,27 +107,27 @@
if(!choice || !CanUseTopic(user))
return TOPIC_NOACTION
if(choice == "Other")
var/raw_choice = sanitize(input(user, "Please enter a religon.", "Character Preference") as text|null, MAX_NAME_LEN)
var/raw_choice = sanitize(input(user, "Please enter a religion.", "Character Preference") as text|null, MAX_NAME_LEN)
if(raw_choice)
pref.religion = sanitize(raw_choice)
else
pref.religion = choice
return TOPIC_REFRESH
else if(href_list["set_medical_records"])
var/new_medical = sanitize(input(user,"Enter medical information here.","Character Preference", html_decode(pref.med_record)) as message|null, MAX_RECORD_LENGTH, extra = 0)
else if(href_list["set_medical_records"]) //2023-03-18, we're using sanitizeSafe() in order to remove <> entirely, allowing us to safely decode it on the pref screen
var/new_medical = html_decode(sanitizeSafe(input(user,"Enter medical information here.","Character Preference", html_decode(pref.med_record)) as message|null, MAX_RECORD_LENGTH, extra = 0))
if(!isnull(new_medical) && !jobban_isbanned(user, "Records") && CanUseTopic(user))
pref.med_record = new_medical
return TOPIC_REFRESH
else if(href_list["set_general_records"])
var/new_general = sanitize(input(user,"Enter employment information here.","Character Preference", html_decode(pref.gen_record)) as message|null, MAX_RECORD_LENGTH, extra = 0)
else if(href_list["set_general_records"]) //2023-03-20, this allows people to use apostrophes in their records!
var/new_general = html_decode(sanitizeSafe(input(user,"Enter employment information here.","Character Preference", html_decode(pref.gen_record)) as message|null, MAX_RECORD_LENGTH, extra = 0))
if(!isnull(new_general) && !jobban_isbanned(user, "Records") && CanUseTopic(user))
pref.gen_record = new_general
return TOPIC_REFRESH
else if(href_list["set_security_records"])
var/sec_medical = sanitize(input(user,"Enter security information here.","Character Preference", html_decode(pref.sec_record)) as message|null, MAX_RECORD_LENGTH, extra = 0)
else if(href_list["set_security_records"]) //Note that html exploits still won't work here because we removed <> earlier.
var/sec_medical = html_decode(sanitizeSafe(input(user,"Enter security information here.","Character Preference", html_decode(pref.sec_record)) as message|null, MAX_RECORD_LENGTH, extra = 0))
if(!isnull(sec_medical) && !jobban_isbanned(user, "Records") && CanUseTopic(user))
pref.sec_record = sec_medical
return TOPIC_REFRESH
code/modules/emotes/emote_mob.dm
+1 -1
View File
@@ -152,7 +152,7 @@
to_chat(src, "You are unable to emote.")
return
message = sanitize(message, encode = FALSE) // This is getting double-encoded somewhere along the line.
message = html_decode(sanitize(message))
if(!message)
return
code/modules/paperwork/handlabeler.dm
+2 -2
View File
@@ -72,8 +72,8 @@
icon_state = "labeler[mode]"
if(mode)
to_chat(user, SPAN_NOTICE("You turn on \the [src]."))
//Now let them chose the text.
var/str = sanitizeSafe(input(user,"Label text?","Set label",""), MAX_NAME_LEN)
//Now let them choose the text.
var/str = html_decode(sanitizeSafe(input(user,"Label text?","Set label",""), MAX_NAME_LEN))
if(!str || !length(str))
to_chat(user, SPAN_WARNING("Invalid text."))
return