warden/early-roguelike
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

arogue5: close security holes.

Browse source 
Prevent whoami (player name), file_name, and score_file from being
changed if the systemwide save location is being used.
This commit is contained in:
John "Elwin" Edwards 2012-08-11 16:27:20 +00:00
parent 4c16144c6b
commit 5ce56875ec
3 changed files with 49 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

27
arogue5/options.c
View file

@ -38,6 +38,7 @@ int put_bool(),
get_bool(),
put_str(),
get_str(),
get_restr(),
put_abil(),
get_abil(),
get_quest(),
@ -57,19 +58,34 @@ OPTION optlist[] = {
{"pickup", "Pick things up automatically: ",
(int *) &auto_pickup, put_bool, get_bool },
{"name", "Name: ",
(int *) whoami, put_str, get_str },
(int *) whoami, put_str, get_restr },
{"fruit", "Fruit: ",
(int *) fruit, put_str, get_str },
{"file", "Save file: ",
(int *) file_name, put_str, get_str },
(int *) file_name, put_str, get_restr },
{"score", "Score file: ",
(int *) score_file, put_str, get_str },
(int *) score_file, put_str, get_restr },
{"class", "Character class: ",
(int *)&char_type, put_abil, get_abil },
{"quest", "Quest item: ",
(int *) &quest_item, put_quest, get_quest }
};
/* For fields that would be restricted if use_savedir is set. */
int get_restr(char *optstr, WINDOW *win)
{
int oy, ox;
if (use_savedir)
{
getyx(win, oy, ox);
put_str(optstr, win);
return get_ro(win, oy, ox);
}
else
return get_str(optstr, win);
}
/*
* The ability field is read-only
*/
@ -343,6 +359,11 @@ register char *str;
* Look it up and deal with it
*/
for (op = optlist; op <= &optlist[NUM_OPTS-1]; op++)
/* None of these can be changed if using system savefiles. */
if (use_savedir && (!strcmp(op->o_name, "name") ||
!strcmp(op->o_name, "file") ||
!strcmp(op->o_name, "score") ))
continue;
if (EQSTR(str, op->o_name, len))
{
if (op->o_putfunc == put_bool) /* if option is a boolean */