0ct0pu5/wesnoth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

The client now checks for unsafe filenames before trying to install a campaign.

Browse source 
If an unsafe filename is found the install is aborted before any previous
version of the campaign is deleted.
This commit is contained in:
Bruno Wolff III 2005-10-16 23:17:58 +00:00
parent 5755c3509d
commit 0b9eb81e2a
2 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
changelog
View file

@ -49,7 +49,7 @@ SVN trunk:
* Support new "timestamp" attribute
* Save persistent attributes in the campaign data
* The campaign name cannot be stored in "name" as that is treated as a
directory name, so use campaign_name instead.
directory name, so use campaign_name instead. (Fixes bug #4525.)
* The campaign server now checks of file and directory names on upload
the same as the campaign name to prevent custom clients from entering
malicious names.
@ -67,6 +67,9 @@ SVN trunk:
names.
* Moved check_names_legal from campaign_server to publish_campaign in
preperation for using it to check downloaded campaigns.
* The download client has been changed to check the safety of names before
trying to install a downloaded campaign. If any unsafe names are found
the install is aborted before any old version of the campaign is removed.
* utils: added weblist.pl and webtgz.pl web interface programs
* updated weblist.pl to display translation information
* updated weblist.pl and webtgz.pl to use standard wesnoth logo banner

5
src/game.cpp
View file

@ -991,6 +991,11 @@ void game_controller::download_campaigns()
return;
}
if(!check_names_legal(cfg)) {
gui::show_error_message(disp(), "The campaign has an invalid file or directory name and can not be installed.");
return;
}
//remove any existing versions of the just downloaded campaign
//assuming it consists of a dir and a cfg file
remove_campaign(campaigns[index]);