From 4906d5ca83377489bd1164c762df0086b443ba46 Mon Sep 17 00:00:00 2001 From: Leshana Date: Thu, 4 Jan 2018 20:52:35 -0500 Subject: [PATCH] Fix exploit allowing choosing unlimited languages on character setup. * Checks list length after input() returns so you can't cheese it. * Sanitizes list to proper length so existing characters over the limit will be fixed. --- code/modules/client/preference_setup/general/02_language.dm | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/code/modules/client/preference_setup/general/02_language.dm b/code/modules/client/preference_setup/general/02_language.dm index d42449ab84..22c8fd1267 100644 --- a/code/modules/client/preference_setup/general/02_language.dm +++ b/code/modules/client/preference_setup/general/02_language.dm @@ -12,6 +12,10 @@ /datum/category_item/player_setup_item/general/language/sanitize_character() if(!islist(pref.alternate_languages)) pref.alternate_languages = list() + if(pref.species) + var/datum/species/S = all_species[pref.species] + if(S && pref.alternate_languages.len > S.num_alternate_languages) + pref.alternate_languages.len = S.num_alternate_languages // Truncate to allowed length if(isnull(pref.language_prefixes) || !pref.language_prefixes.len) pref.language_prefixes = config.language_prefixes.Copy() @@ -61,7 +65,7 @@ alert(user, "There are no additional languages available to select.") else var/new_lang = input(user, "Select an additional language", "Character Generation", null) as null|anything in available_languages - if(new_lang) + if(new_lang && pref.alternate_languages.len < S.num_alternate_languages) pref.alternate_languages |= new_lang return TOPIC_REFRESH