aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBlockhead <?>2020-01-04 18:33:57 +0100
committerorwell96 <orwell@bleipb.de>2020-01-04 18:33:57 +0100
commitc0c6fcf00b7da9ae179ae070664b0655c10c37c5 (patch)
tree344c5ed3de32ac8b1b4969b5e0dea8bb82de4257
parentb905a8bf6d753a80ab35615adb9694f8906d11d0 (diff)
Apply minetest.formspec_escape() to prevent formspec injection (H#143)MT0.4
-rw-r--r--advtrains/wagons.lua8
-rw-r--r--advtrains_interlocking/route_ui.lua4
-rw-r--r--advtrains_interlocking/tcb_ts_ui.lua12
-rw-r--r--advtrains_line_automation/stoprail.lua2
#include "map.h" class SmokePuffCSO: public ClientSimpleObject { float m_age; scene::IBillboardSceneNode *m_spritenode; public: SmokePuffCSO(scene::ISceneManager *smgr, ClientEnvironment *env, v3f pos, v2f size): m_age(0), m_spritenode(NULL) { infostream<<"SmokePuffCSO: constructing"<<std::endl; m_spritenode = smgr->addBillboardSceneNode( NULL, v2f(1,1), pos, -1); m_spritenode->setMaterialTexture(0, env->getGameDef()->tsrc()->getTextureForMesh("smoke_puff.png")); m_spritenode->setMaterialFlag(video::EMF_LIGHTING, false); m_spritenode->setMaterialFlag(video::EMF_BILINEAR_FILTER, false); //m_spritenode->setMaterialType(video::EMT_TRANSPARENT_ALPHA_CHANNEL_REF); m_spritenode->setMaterialType(video::EMT_TRANSPARENT_ALPHA_CHANNEL); m_spritenode->setMaterialFlag(video::EMF_FOG_ENABLE, true); m_spritenode->setColor(video::SColor(255,0,0,0)); m_spritenode->setVisible(true); m_spritenode->setSize(size); /* Update brightness */ u8 light; bool pos_ok; MapNode n = env->getMap().getNodeNoEx(floatToInt(pos, BS), &pos_ok); light = pos_ok ? decode_light(n.getLightBlend(env->getDayNightRatio(), env->getGameDef()->ndef())) : 64; video::SColor color(255,light,light,light); m_spritenode->setColor(color); } virtual ~SmokePuffCSO() { infostream<<"SmokePuffCSO: destructing"<<std::endl; m_spritenode->remove(); } void step(float dtime) { m_age += dtime; if(m_age > 1.0){ m_to_be_removed = true; } } }; ClientSimpleObject* createSmokePuff(scene::ISceneManager *smgr, ClientEnvironment *env, v3f pos, v2f size) { return new SmokePuffCSO(smgr, env, pos, size); }
iv>
+ form = form.."label[0.5,3.0;"..minetest.formspec_escape(rte.name).."]"
if tcbs.route_committed then
form = form.."label[0.5,3.5;Route has been set.]"
else
form = form.."label[0.5,3.5;Waiting for route to be set...]"
if tcbs.route_rsn then
- form = form.."label[0.5,4;"..tcbs.route_rsn.."]"
+ form = form.."label[0.5,4;"..minetest.formspec_escape(tcbs.route_rsn).."]"
end
end
if not tcbs.route_auto then
diff --git a/advtrains_line_automation/stoprail.lua b/advtrains_line_automation/stoprail.lua
index 0db474f..0990876 100644
--- a/advtrains_line_automation/stoprail.lua
+++ b/advtrains_line_automation/stoprail.lua
@@ -58,7 +58,7 @@ local function show_stoprailform(pos, player)
form = form.."dropdown[0.5,3;2;doors;Left,Right,Closed;"..door_dropdown[stdata.doors].."]"
form = form.."dropdown[3,3;1.5;reverse;---,Reverse;"..(stdata.reverse and 2 or 1).."]"
- form = form.."field[5,3.5;2,1;track;"..attrans("Track")..";"..stdata.track.."]"
+ form = form.."field[5,3.5;2,1;track;"..attrans("Track")..";"..minetest.formspec_escape(stdata.track).."]"
form = form.."field[5,4.5;2,1;wait;"..attrans("Stop Time")..";"..stdata.wait.."]"
form = form.."textarea[0.5,4;4,2;ars;Trains stopping here (ARS rules);"..advtrains.interlocking.ars_to_text(stdata.ars).."]"
diff --git a/advtrains_luaautomation/active_common.lua b/advtrains_luaautomation/active_common.lua
index c17c6e9..48f75ac 100644
--- a/advtrains_luaautomation/active_common.lua
+++ b/advtrains_luaautomation/active_common.lua
@@ -36,7 +36,7 @@ function ac.getform(pos, meta_p)
end
local sel = 1
for n,_ in pairs(atlatc.envs) do
- envs_asvalues[#envs_asvalues+1]=n
+ envs_asvalues[#envs_asvalues+1]=minetest.formspec_escape(n)
if n==env then
sel=#envs_asvalues
end
diff --git a/advtrains_luaautomation/pcnaming.lua b/advtrains_luaautomation/pcnaming.lua
index 427585d..ebb769f 100644
--- a/advtrains_luaautomation/pcnaming.lua
+++ b/advtrains_luaautomation/pcnaming.lua
@@ -52,7 +52,7 @@ minetest.register_craftitem("advtrains_luaautomation:pcnaming",{
pn=name
end
end
- minetest.show_formspec(pname, "atlatc_naming_"..minetest.pos_to_string(pos), "field[pn;Set name of component (empty to clear);"..pn.."]")
+ minetest.show_formspec(pname, "atlatc_naming_"..minetest.pos_to_string(pos), "field[pn;Set name of component (empty to clear);"..minetest.formspec_escape(pn).."]")
end
end
end,