From d8bef8e04ea3b028c339a098f80249b2d706c406 Mon Sep 17 00:00:00 2001 From: Jordan Brown Date: Thu, 10 May 2018 14:39:15 -0400 Subject: [PATCH 1/2] [s] Fixes an admin unprotected var read/write exploit --- code/modules/clothing/clothing.dm | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/code/modules/clothing/clothing.dm b/code/modules/clothing/clothing.dm index b15109bcb1..4b77dee806 100644 --- a/code/modules/clothing/clothing.dm +++ b/code/modules/clothing/clothing.dm @@ -81,12 +81,21 @@ /obj/item/clothing/equipped(mob/user, slot) ..() - + if (!istype(user)) + return if(slot_flags & slotdefine2slotbit(slot)) //Was equipped to a valid slot for this item? +<<<<<<< HEAD for(var/variable in user_vars_to_edit) if(variable in user.vars) user_vars_remembered[variable] = user.vars[variable] user.vars[variable] = user_vars_to_edit[variable] +======= + if (LAZYLEN(user_vars_to_edit)) + for(var/variable in user_vars_to_edit) + if(variable in user.vars) + LAZYSET(user_vars_remembered, variable, user.vars[variable]) + user.vv_edit_var(variable, user_vars_to_edit[variable]) +>>>>>>> 1f887a4... Merge pull request #37782 from vuonojenmustaturska/ohno /obj/item/clothing/examine(mob/user) ..() From 76ab6ff6585ff874568b62b70c1bc5ace55a16ed Mon Sep 17 00:00:00 2001 From: deathride58 Date: Thu, 10 May 2018 23:34:46 -0400 Subject: [PATCH 2/2] Update clothing.dm --- code/modules/clothing/clothing.dm | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/code/modules/clothing/clothing.dm b/code/modules/clothing/clothing.dm index 4b77dee806..9ab929ba20 100644 --- a/code/modules/clothing/clothing.dm +++ b/code/modules/clothing/clothing.dm @@ -84,18 +84,11 @@ if (!istype(user)) return if(slot_flags & slotdefine2slotbit(slot)) //Was equipped to a valid slot for this item? -<<<<<<< HEAD - for(var/variable in user_vars_to_edit) - if(variable in user.vars) - user_vars_remembered[variable] = user.vars[variable] - user.vars[variable] = user_vars_to_edit[variable] -======= if (LAZYLEN(user_vars_to_edit)) for(var/variable in user_vars_to_edit) if(variable in user.vars) LAZYSET(user_vars_remembered, variable, user.vars[variable]) user.vv_edit_var(variable, user_vars_to_edit[variable]) ->>>>>>> 1f887a4... Merge pull request #37782 from vuonojenmustaturska/ohno /obj/item/clothing/examine(mob/user) ..() @@ -294,4 +287,4 @@ BLIND // can't see anything Shreds.desc = "The sad remains of what used to be [name]." deconstruct(FALSE) else - ..() \ No newline at end of file + ..()