mirror of
https://github.com/UberGames/lilium-voyager.git
synced 2024-12-12 21:22:14 +00:00
3638f69dff
VMs could set fs_game to '..' at anytime to access files outside of home and base path. fs_game sent by server to clients could also be '..' to access files outside of home and base path. '..' was not caught by FS_CheckDirTraversal() as it expects filenames not a single directory. I've made fs_game be latched to prevent VMs from changing it with no good way to validate it before it's used. com_basegame and fs_basegame are now latched as well. Additionally, it's now possible to change com_basegame while the engine is running. game_restart or vid_restart will make it take affect. com_homepath is now CVAR_PROTECTED to prevent VMs from changing it to a directory traversal. This requires my two previous commits for preventing VMs from changing engine latch cvars and only Cvar_Get fs_game in FS_Startup (so CVAR_INIT isn't added in serveral other places). Reported by Noah Metzger (Chomenor). |
||
|---|---|---|
| .. | ||
| AL | ||
| asm | ||
| autoupdater | ||
| botlib | ||
| cgame | ||
| client | ||
| curl-7.54.0/include | ||
| game | ||
| jpeg-8c | ||
| libogg-1.3.2 | ||
| libs | ||
| libvorbis-1.3.5 | ||
| null | ||
| opus-1.1.4 | ||
| opusfile-0.8 | ||
| q3_ui | ||
| qcommon | ||
| renderercommon | ||
| renderergl1 | ||
| renderergl2 | ||
| sdl | ||
| SDL2/include | ||
| server | ||
| sys | ||
| tools | ||
| ui | ||
| zlib | ||