Skip to content

Conversation

@menesakdeniz
Copy link
Contributor

Lets say we have override the sm_unmute command and changed it to ADMFLAG_CUSTOM1.
Then create an admin, we gived our admin ADMFLAG_Chat flag, admin can't use sm_unmute command cause it doesnt have access to this command.
But if admin go into "!admin" menu then, he will able to run sm_unmute on "player command" menus

this vulnerability also affects mute,gag and silence commands

Lets say we have override the sm_unmute command and changed it to ADMFLAG_CUSTOM1.
Then create an admin, we gived our admin ADMFLAG_Chat flag, admin can't use sm_unmute command cause it doesnt have access to this command.
But if admin go into "!admin" menu then, he will able to run sm_unmute on "player command" menus
@peace-maker
Copy link
Member

Nice catch. I'm not sure if showing the disabled options is useful though. You should just not add the menu option at all if the user doesn't have access to it.

@menesakdeniz
Copy link
Contributor Author

i made this way because if the admin wants to see if user gagged or not. It can be changed easily

@peace-maker
Copy link
Member

Seeing who is muted is part of the permission in my opinion. If you can't use sm_mute you shouldn't see anything about it anywhere.

@menesakdeniz
Copy link
Contributor Author

Well, I changed it according to your opinion

Copy link
Member

@peace-maker peace-maker left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you, this looks good except for the nits! 👍

@peace-maker peace-maker merged commit 726db5a into alliedmodders:1.10-dev Oct 24, 2020
@peace-maker
Copy link
Member

Thank you!

@psychonic
Copy link
Member

psychonic commented Oct 24, 2020 via email

asherkin pushed a commit that referenced this pull request Oct 24, 2020
* Improvements on !admin menu flags

Lets say we have override the sm_unmute command and changed it to ADMFLAG_CUSTOM1.
Then create an admin, we gived our admin ADMFLAG_Chat flag, admin can't use sm_unmute command cause it doesnt have access to this command.
But if admin go into "!admin" menu then, he will able to run sm_unmute on "player command" menus

* removed unauthorized menu items

* Deleted Whitespace and ITEMDRAW_DEFAULT
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants