sanitise vote reason strings

assaultcube · Jan 21, 2016 · 1e5e05f · 1e5e05f · GreenLunar · Jan 23, 2016
1 parent 48d09fc
commit 1e5e05f
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 7 deletions.
diff --git a/source/src/server.cpp b/source/src/server.cpp
@@ -2139,7 +2139,7 @@ struct voteinfo
     enet_uint32 host;
 
     voteinfo() : boot(0), owner(0), callmillis(0), result(VOTE_NEUTRAL), action(NULL), gonext(false), host(0) {}
-    ~voteinfo() { delete action; }
+    ~voteinfo() { DELETEP(action); }
 
     void end(int result)
     {
@@ -2819,8 +2819,7 @@ void process(ENetPacket *packet, int sender, int chan)
         if(type!=SV_POS && type!=SV_POSC && type!=SV_CLIENTPING && type!=SV_PING && type!=SV_CLIENT)
         {
             DEBUGVAR(cl->name);
-            ASSERT(type>=0 && type<SV_NUM);
-            DEBUGVAR(messagenames[type]);
+            if(type >= 0) { DEBUGVAR(messagenames[type]); }
             protocoldebug(DEBUGCOND);
         }
         else protocoldebug(false);
@@ -3504,21 +3503,23 @@ void process(ENetPacket *packet, int sender, int chan)
                     {
                         vi->num1 = cn2boot = getint(p);
                         getstring(text, p);
+                        text[61] = '\0';
                         strncpy(vi->text,text,128);
                         filtertext(text, text, FTXT__KICKBANREASON);
                         trimtrailingwhitespace(text);
-                        vi->action = new kickaction(cn2boot, newstring(text, 128));
+                        if(strlen(text) > 3 && !strstr(text, "   ")) vi->action = new kickaction(cn2boot, text);
                         vi->boot = 1;
                         break;
                     }
                     case SA_BAN:
                     {
                         vi->num1 = cn2boot = getint(p);
                         getstring(text, p);
+                        text[61] = '\0';
                         strncpy(vi->text,text,128);
                         filtertext(text, text, FTXT__KICKBANREASON);
                         trimtrailingwhitespace(text);
-                        vi->action = new banaction(cn2boot, newstring(text, 128));
+                        if(strlen(text) > 3 && !strstr(text, "   ")) vi->action = new banaction(cn2boot, text);
                         vi->boot = 2;
                         break;
                     }

diff --git a/source/src/serveractions.h b/source/src/serveractions.h
@@ -203,7 +203,7 @@ struct kickaction : playeraction
     {
         wasvalid = false;
         role = roleconf('k');
-        if(isvalid() && strlen(reason) > 3 && valid_client(cn))
+        if(isvalid())
         {
             wasvalid = true;
             formatstring(desc)("kick player %s, reason: %s", clients[cn]->name, reason);
@@ -224,7 +224,7 @@ struct banaction : playeraction
     {
         wasvalid = false;
         role = roleconf('b');
-        if(isvalid() && strlen(reason) > 3)
+        if(isvalid())
         {
             wasvalid = true;
             formatstring(desc)("ban player %s, reason: %s", clients[cn]->name, reason);