0ct0pu5/wesnoth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Disallow inclusion of .pbl files from WML (bug #23504)

Browse source 
Note that this will also cause Lua wesnoth.have_file() to return false
on .pbl files.
This commit is contained in:
Ignacio R. Morelle 2015-06-09 06:12:09 -03:00
parent e2df198e55
commit f891446818
3 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
changelog
View file

@ -65,6 +65,7 @@ Version 1.13.0+dev:
* Made silence.ogg larger to work around a crash involving the multiplayer
lobby with music and sound enabled (bug #23633, possibly also bug #23599,
bug #23203, bug #23026).
* Disallowed inclusion of .pbl files from WML (bug #23504).
Version 1.13.0:
* Security fixes:

5
src/filesystem.cpp
View file

@ -1008,6 +1008,11 @@ std::string get_wml_location(const std::string &filename, const std::string &cur
return result;
}
if (ends_with(filename, ".pbl")) {
ERR_FS << "Illegal path '" << filename << "' (.pbl files are not allowed)." << std::endl;
return result;
}
bool already_found = false;
if (filename[0] == '~')

5
src/filesystem_boost.cpp
View file

@ -1000,6 +1000,11 @@ static bool is_legal_file(const std::string &filename)
return false;
}
if (ends_with(filename, ".pbl")) {
ERR_FS << "Illegal path '" << filename << "' (.pbl files are not allowed)." << std::endl;
return false;
}
return true;
}