From f7ae896aeb8c3ff29aa97e0cf255dea078dc6f1d Mon Sep 17 00:00:00 2001 From: deathride58 Date: Tue, 9 Aug 2022 18:22:02 -0400 Subject: [PATCH 1/2] fixes small fail2topic vulnerability --- code/controllers/subsystem/fail2topic.dm | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/code/controllers/subsystem/fail2topic.dm b/code/controllers/subsystem/fail2topic.dm index fc18d7dabe..bdbfe10b6f 100644 --- a/code/controllers/subsystem/fail2topic.dm +++ b/code/controllers/subsystem/fail2topic.dm @@ -44,7 +44,19 @@ SUBSYSTEM_DEF(fail2topic) /datum/controller/subsystem/fail2topic/Shutdown() DropFirewallRule() +/datum/controller/subsystem/fail2topic/CanProcCall(procname) + . = ..() + if(.) + switch(procname) + if("IsRateLimited") + return FALSE + if("BanFromFirewall") + return FALSE + /datum/controller/subsystem/fail2topic/proc/IsRateLimited(ip) + if(IsAdminAdvancedProcCall()) + return FALSE + var/last_attempt = rate_limiting[ip] var/static/datum/config_entry/keyed_list/topic_rate_limit_whitelist/cached_whitelist_entry @@ -82,6 +94,8 @@ SUBSYSTEM_DEF(fail2topic) /datum/controller/subsystem/fail2topic/proc/BanFromFirewall(ip) if (!enabled) return + if(IsAdminAdvancedProcCall()) + return active_bans[ip] = REALTIMEOFDAY fail_counts -= ip From 2f4a095363ed8a7e9ecf474d0f25f62960b760f8 Mon Sep 17 00:00:00 2001 From: deathride58 Date: Tue, 9 Aug 2022 18:40:02 -0400 Subject: [PATCH 2/2] blacklists rule_name varedits --- code/controllers/subsystem/fail2topic.dm | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/code/controllers/subsystem/fail2topic.dm b/code/controllers/subsystem/fail2topic.dm index bdbfe10b6f..47f14a0065 100644 --- a/code/controllers/subsystem/fail2topic.dm +++ b/code/controllers/subsystem/fail2topic.dm @@ -44,6 +44,11 @@ SUBSYSTEM_DEF(fail2topic) /datum/controller/subsystem/fail2topic/Shutdown() DropFirewallRule() +/datum/controller/subsystem/fail2topic/vv_edit_var(var_name, var_value) + if(var_name == NAMEOF(src, rule_name)) + return FALSE + return ..() + /datum/controller/subsystem/fail2topic/CanProcCall(procname) . = ..() if(.)