HM-CODE / Haunted-Memories

A repository for Haunted Memories code.
http://www.haunted-memories.net/
BSD 3-Clause "New" or "Revised" License
4 stars 5 forks source link

+judge/call misbehaves on semicolons - possible security issue #126

Closed Bradamante closed 13 years ago

Bradamante commented 13 years ago

When a player issues a +judge/call command and includes a semicolon in the explanation, the text added to the job cuts off at the semicolon. The text after the semicolon appears to be cut off and processed separately, and produces an error message; this may be a security problem.

Initial report:

+judge/call Vampire=I may need a judge soon, on account of Nathaniel and Andreas coming to my throne room and acting like fools. It is unwise to disrespect a Gangrel to her face, let alone a Gangrel Empress. No need to join just yet; this may blow over. Just a heads up in case it does not.

You have requested a Vampire judge. Please allow the staff a moment to respond, a +myjob has been added for you. Perhaps you need 'help'? You have requested Judge Call from staff. Please allow for some time to process it. Do not page staff about it - you will hear back soon. On investigation on the test server, this produced the same results, and the job text consisted of: [1+] Chana added on Thu Sep 15 17:23:49 2011: Chana has requested a Vampire judge at Flat -- Kai Clinic -- Loewen Street -- South Side (#8130). Reason: I may need a judge soon, on account of Nathaniel and Andreas coming to my throne room and acting like fools. It is unwise to disrespect a Gangrel to her face, let alone a Gangrel Empress. No need to join just yet
lashtear commented 13 years ago

Good grief. Fixed and deployed that command.