0ct0pu5/wesnoth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Disallow inclusion of .pbl files from WML (bug #23504)

Browse source 
Note that this will also cause Lua wesnoth.have_file() to return false
on .pbl files.
This commit is contained in:
Ignacio R. Morelle 2015-06-09 06:12:09 -03:00
parent 78848c2cef
commit f1512512de
3 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
changelog
View file

@ -37,6 +37,7 @@ Version 1.12.2+dev:
* Made silence.ogg larger to work around a crash involving the multiplayer
lobby with music and sound enabled (bug #23633, possibly also bug #23599,
bug #23203, bug #23026).
* Disallowed inclusion of .pbl files from WML (bug #23504).
Version 1.12.2:
* Security fixes:

5
src/filesystem.cpp
View file

@ -1025,6 +1025,11 @@ std::string get_wml_location(const std::string &filename, const std::string &cur
return result;
}
if (ends_with(filename, ".pbl")) {
ERR_FS << "Illegal path '" << filename << "' (.pbl files are not allowed)." << std::endl;
return result;
}
bool already_found = false;
if (filename[0] == '~')

5
src/filesystem_boost.cpp
View file

@ -979,6 +979,11 @@ static bool is_legal_file(const std::string &filename)
return false;
}
if (ends_with(filename, ".pbl")) {
ERR_FS << "Illegal path '" << filename << "' (.pbl files are not allowed)." << std::endl;
return false;
}
return true;
}