cyberpresidentvanellope/Polaris
1
0
Fork 0
mirror of https://github.com/PolarisSS13/Polaris.git synced 2026-07-20 20:52:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

mob: fix #4955

Browse Source 
Name parameter to track wasn't sanitized correctly.

Signed-off-by: Mloc-Hibernia <colmohici@gmail.com>
This commit is contained in:
Mloc-Hibernia
2014-05-10 22:33:33 +00:00
parent 963216b43b
commit 1d2ce01039
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/mob/hear_say.dm
+2 -2
View File
@@ -124,11 +124,11 @@
if(changed_voice)
if(impersonating)
track = "<a href='byond://?src=\ref[src];trackname=[speaker_name];track=\ref[impersonating]'>[speaker_name] ([jobname])</a>"
track = "<a href='byond://?src=\ref[src];trackname=[html_encode(speaker_name)];track=\ref[impersonating]'>[speaker_name] ([jobname])</a>"
else
track = "[speaker_name] ([jobname])"
else
track = "<a href='byond://?src=\ref[src];trackname=[speaker_name];track=\ref[speaker]'>[speaker_name] ([jobname])</a>"
track = "<a href='byond://?src=\ref[src];trackname=[html_encode(speaker_name)];track=\ref[speaker]'>[speaker_name] ([jobname])</a>"
if(istype(src, /mob/dead/observer))
if(speaker_name != speaker.real_name && !isAI(speaker)) //Announce computer and various stuff that broadcasts doesn't use it's real name but AI's can't pretend to be other mobs.
code/modules/mob/living/silicon/ai/ai.dm
+2 -2
View File
@@ -418,10 +418,10 @@ var/list/ai_list = list()
if(index)
seeking = copytext(seeking, 1, index-1)
if(target && href_list["trackname"] == seeking)
if(target && html_decode(href_list["trackname"]) == seeking)
ai_actual_track(target)
else
src << "\red System error. Cannot locate [href_list["trackname"]]."
src << "\red System error. Cannot locate [html_decode(href_list["trackname"])]."
return
else if (href_list["faketrack"])