okseby/Quake-III-Arena
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

(#3767) Some protection from malicious qvms - patches and ideas by Amanieu d'Antras and Ben Millwood

Browse source
This commit is contained in:
Thilo Schulz 2011-03-08 01:39:34 +00:00
parent 657c791257
commit 8c3f320504
12 changed files with 155 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

49
code/qcommon/cvar.c
View file

@ -363,6 +363,18 @@ cvar_t *Cvar_Get( const char *var_name, const char *var_value, int flags ) {
flags &= ~CVAR_VM_CREATED;
}
// Make sure servers cannot mark engine-added variables as SERVER_CREATED
if(var->flags & CVAR_SERVER_CREATED)
{
if(!(flags & CVAR_SERVER_CREATED))
var->flags &= ~CVAR_SERVER_CREATED;
}
else
{
if(flags & CVAR_SERVER_CREATED)
flags &= ~CVAR_SERVER_CREATED;
}
var->flags |= flags;
// only allow one non-empty reset string without a warning
@ -610,6 +622,28 @@ void Cvar_Set( const char *var_name, const char *value) {
Cvar_Set2 (var_name, value, qtrue);
}
/*
============
Cvar_SetSafe
============
*/
void Cvar_SetSafe( const char *var_name, const char *value )
{
int flags = Cvar_Flags( var_name );
if( flags != CVAR_NONEXISTENT && flags & CVAR_PROTECTED )
{
if( value )
Com_Error( ERR_DROP, "Restricted source tried to set "
"\"%s\" to \"%s\"\n", var_name, value );
else
Com_Error( ERR_DROP, "Restricted source tried to "
"modify \"%s\"\n", var_name );
return;
}
Cvar_Set( var_name, value );
}
/*
============
Cvar_SetLatched
@ -635,6 +669,21 @@ void Cvar_SetValue( const char *var_name, float value) {
Cvar_Set (var_name, val);
}
/*
============
Cvar_SetValueSafe
============
*/
void Cvar_SetValueSafe( const char *var_name, float value )
{
char val[32];
if( Q_isintegral( value ) )
Com_sprintf( val, sizeof(val), "%i", (int)value );
else
Com_sprintf( val, sizeof(val), "%f", value );
Cvar_SetSafe( var_name, val );
}
/*
============