moparisthebest/minetest
1
0
Fork 0
mirror of https://github.com/moparisthebest/minetest synced 2024-11-04 08:25:01 -05:00
Code Issues Releases Wiki Activity

Always escape user provided data in mainmenu fields

Browse Source
This commit is contained in:
Kahrl 2014-12-08 07:47:51 +01:00
parent 2fd3d52020
commit d0be823807
3 changed files with 16 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
builtin/mainmenu/tab_multiplayer.lua
View File

@ -24,8 +24,10 @@ local function get_formspec(tabview, name, tabdata)
"label[1,-0.25;".. fgettext("Favorites:") .. "]".. "label[1,-0.25;".. fgettext("Favorites:") .. "]"..
"label[1,4.25;".. fgettext("Address/Port") .. "]".. "label[1,4.25;".. fgettext("Address/Port") .. "]"..
"label[9,2.75;".. fgettext("Name/Password") .. "]" .. "label[9,2.75;".. fgettext("Name/Password") .. "]" ..
"field[1.25,5.25;5.5,0.5;te_address;;" ..core.setting_get("address") .."]" .. "field[1.25,5.25;5.5,0.5;te_address;;" ..
"field[6.75,5.25;2.25,0.5;te_port;;" ..core.setting_get("remote_port") .."]" .. core.formspec_escape(core.setting_get("address")) .."]" ..
"field[6.75,5.25;2.25,0.5;te_port;;" ..
core.formspec_escape(core.setting_get("remote_port")) .."]" ..
"checkbox[1,3.6;cb_public_serverlist;".. fgettext("Public Serverlist") .. ";" .. "checkbox[1,3.6;cb_public_serverlist;".. fgettext("Public Serverlist") .. ";" ..
dump(core.setting_getbool("public_serverlist")) .. "]" dump(core.setting_getbool("public_serverlist")) .. "]"
@ -36,7 +38,8 @@ local function get_formspec(tabview, name, tabdata)
retval = retval .. retval = retval ..
"button[9,4.95;2.5,0.5;btn_mp_connect;".. fgettext("Connect") .. "]" .. "button[9,4.95;2.5,0.5;btn_mp_connect;".. fgettext("Connect") .. "]" ..
"field[9.3,3.75;2.5,0.5;te_name;;" ..core.setting_get("name") .."]" .. "field[9.3,3.75;2.5,0.5;te_name;;" ..
core.formspec_escape(core.setting_get("name")) .."]" ..
"pwdfield[9.3,4.5;2.5,0.5;te_pwd;]" .. "pwdfield[9.3,4.5;2.5,0.5;te_pwd;]" ..
"textarea[9.3,0.25;2.5,2.75;;" "textarea[9.3,0.25;2.5,2.75;;"

8
builtin/mainmenu/tab_server.lua
View File

@ -36,20 +36,20 @@ local function get_formspec(tabview, name, tabdata)
"checkbox[0.5,1.15;cb_server_announce;".. fgettext("Public") .. ";" .. "checkbox[0.5,1.15;cb_server_announce;".. fgettext("Public") .. ";" ..
dump(core.setting_getbool("server_announce")) .. "]".. dump(core.setting_getbool("server_announce")) .. "]"..
"field[0.8,3.2;3.5,0.5;te_playername;".. fgettext("Name") .. ";" .. "field[0.8,3.2;3.5,0.5;te_playername;".. fgettext("Name") .. ";" ..
core.setting_get("name") .. "]" .. core.formspec_escape(core.setting_get("name")) .. "]" ..
"pwdfield[0.8,4.2;3.5,0.5;te_passwd;".. fgettext("Password") .. "]" "pwdfield[0.8,4.2;3.5,0.5;te_passwd;".. fgettext("Password") .. "]"
local bind_addr = core.setting_get("bind_address") local bind_addr = core.setting_get("bind_address")
if bind_addr ~= nil and bind_addr ~= "" then if bind_addr ~= nil and bind_addr ~= "" then
retval = retval .. retval = retval ..
"field[0.8,5.2;2.25,0.5;te_serveraddr;".. fgettext("Bind Address") .. ";" .. "field[0.8,5.2;2.25,0.5;te_serveraddr;".. fgettext("Bind Address") .. ";" ..
core.setting_get("bind_address") .."]" .. core.formspec_escape(core.setting_get("bind_address")) .."]" ..
"field[3.05,5.2;1.25,0.5;te_serverport;".. fgettext("Port") .. ";" .. "field[3.05,5.2;1.25,0.5;te_serverport;".. fgettext("Port") .. ";" ..
core.setting_get("port") .."]" core.formspec_escape(core.setting_get("port")) .."]"
else else
retval = retval .. retval = retval ..
"field[0.8,5.2;3.5,0.5;te_serverport;".. fgettext("Server Port") .. ";" .. "field[0.8,5.2;3.5,0.5;te_serverport;".. fgettext("Server Port") .. ";" ..
core.setting_get("port") .."]" core.formspec_escape(core.setting_get("port")) .."]"
end end
retval = retval .. retval = retval ..

9
builtin/mainmenu/tab_simple_main.lua
View File

@ -23,14 +23,17 @@ local function get_formspec(tabview, name, tabdata)
retval = retval .. retval = retval ..
"label[8,0.5;".. fgettext("Name/Password") .. "]" .. "label[8,0.5;".. fgettext("Name/Password") .. "]" ..
"field[0.25,3.25;5.5,0.5;te_address;;" ..core.setting_get("address") .."]" .. "field[0.25,3.25;5.5,0.5;te_address;;" ..
"field[5.75,3.25;2.25,0.5;te_port;;" ..core.setting_get("remote_port") .."]" .. core.formspec_escape(core.setting_get("address")) .."]" ..
"field[5.75,3.25;2.25,0.5;te_port;;" ..
core.formspec_escape(core.setting_get("remote_port")) .."]" ..
"checkbox[8,-0.25;cb_public_serverlist;".. fgettext("Public Serverlist") .. ";" .. "checkbox[8,-0.25;cb_public_serverlist;".. fgettext("Public Serverlist") .. ";" ..
render_details .. "]" render_details .. "]"
retval = retval .. retval = retval ..
"button[8,2.5;4,1.5;btn_mp_connect;".. fgettext("Connect") .. "]" .. "button[8,2.5;4,1.5;btn_mp_connect;".. fgettext("Connect") .. "]" ..
"field[8.75,1.5;3.5,0.5;te_name;;" ..core.setting_get("name") .."]" .. "field[8.75,1.5;3.5,0.5;te_name;;" ..
core.formspec_escape(core.setting_get("name")) .."]" ..
"pwdfield[8.75,2.3;3.5,0.5;te_pwd;]" "pwdfield[8.75,2.3;3.5,0.5;te_pwd;]"
--favourites --favourites