warden/early-roguelike
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

arogue5: close security holes.

Browse source 
Prevent whoami (player name), file_name, and score_file from being
changed if the systemwide save location is being used.
This commit is contained in:
John "Elwin" Edwards 2012-08-11 16:27:20 +00:00
parent 4c16144c6b
commit 5ce56875ec
3 changed files with 49 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

13
arogue5/save.c
View file

@ -41,7 +41,10 @@ save_game()
mpos = 0;
if (file_name[0] != '\0')
{
msg("Save file (%s)? ", file_name);
if (use_savedir)
msg("Save game? ");
else
msg("Save file (%s)? ", file_name);
do
{
c = readchar();
@ -53,6 +56,10 @@ save_game()
msg("File name: %s", file_name);
goto gotfile;
}
if (use_savedir) {
msg("");
return FALSE;
}
}
do
@ -69,7 +76,11 @@ save_game()
strcpy(file_name, buf);
gotfile:
if ((savef = fopen(file_name, "w")) == NULL)
{
msg(strerror(errno)); /* fake perror() */
if (use_savedir)
return FALSE;
}
} while (savef == NULL);
/*