search

barzerman / barzer

barzer engine code
MIT License
2 stars 0 forks source link

security: !!EMIT has no limits #591

Closed nchepanov closed 11 years ago

nchepanov commented 11 years ago

when barsted sends <stmtset> to list all emits it is possible that someone send <perm>1 2 3 4 56 7 8 9 9 0</perm> and the whole server gets swapped

barzerman commented 11 years ago

change pushed. limit set to 1024 expands if the number is exceeded the last PAT tag looks like this:

<pat n="1025" err="too many emits"><t>TOO MANY EMITS ...</t></pat>