From 46fbf89acfe3d182bf497bfa622cd4876d53d7da Mon Sep 17 00:00:00 2001 From: gpcf Date: Sun, 11 Aug 2024 23:22:36 +0200 Subject: Fix privilege check when using the PC naming tool This fix prevents malicious modified clients from using the PC tool without the necessary privileges. --- advtrains_luaautomation/pcnaming.lua | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) (limited to 'advtrains_luaautomation') diff --git a/advtrains_luaautomation/pcnaming.lua b/advtrains_luaautomation/pcnaming.lua index 71f4d9a..5624b74 100644 --- a/advtrains_luaautomation/pcnaming.lua +++ b/advtrains_luaautomation/pcnaming.lua @@ -22,6 +22,9 @@ function atlatc.pcnaming.resolve_pos(pos, func_name) error("Invalid position supplied to " .. (func_name or "???")..": " .. dump(pos)) end + +local pcrename = {} + minetest.register_craftitem("advtrains_luaautomation:pcnaming",{ description = attrans("Passive Component Naming Tool\n\nRight-click to name a passive component."), groups = {cracky=1}, -- key=name, value=rating; rating=1..3. @@ -43,6 +46,7 @@ minetest.register_craftitem("advtrains_luaautomation:pcnaming",{ minetest.record_protection_violation(pos, pname) return end + local node = advtrains.ndb.get_node(pos) local ndef = minetest.registered_nodes[node.name] if node.name and ( @@ -57,16 +61,17 @@ minetest.register_craftitem("advtrains_luaautomation:pcnaming",{ pn=name end end - minetest.show_formspec(pname, "atlatc_naming_"..minetest.pos_to_string(pos), "field[pn;Set name of component (empty to clear);"..minetest.formspec_escape(pn).."]") + pcrename[pname] = pos + minetest.show_formspec(pname, "atlatc_naming", "field[pn;Set name of component (empty to clear);"..minetest.formspec_escape(pn).."]") end end end, }) minetest.register_on_player_receive_fields(function(player, formname, fields) - local pts=string.match(formname, "^atlatc_naming_(.+)") - if pts then - local pos=minetest.string_to_pos(pts) - if fields.pn then + if formname == "atlatc_naming" then + local pname = player:get_player_name() + local pos=pcrename[pname] + if fields.pn and pos then --first remove all occurences for name, npos in pairs(atlatc.pcnaming.name_map) do if vector.equals(npos, pos) then -- cgit v1.2.3