mirror of
https://github.com/UberGames/lilium-voyager.git
synced 2025-02-24 20:01:16 +00:00
3638f69dff
VMs could set fs_game to '..' at anytime to access files outside of home and base path. fs_game sent by server to clients could also be '..' to access files outside of home and base path. '..' was not caught by FS_CheckDirTraversal() as it expects filenames not a single directory. I've made fs_game be latched to prevent VMs from changing it with no good way to validate it before it's used. com_basegame and fs_basegame are now latched as well. Additionally, it's now possible to change com_basegame while the engine is running. game_restart or vid_restart will make it take affect. com_homepath is now CVAR_PROTECTED to prevent VMs from changing it to a directory traversal. This requires my two previous commits for preventing VMs from changing engine latch cvars and only Cvar_Get fs_game in FS_Startup (so CVAR_INIT isn't added in serveral other places). Reported by Noah Metzger (Chomenor). |
||
|---|---|---|
| .. | ||
| cl_avi.c | ||
| cl_cgame.c | ||
| cl_cin.c | ||
| cl_console.c | ||
| cl_curl.c | ||
| cl_curl.h | ||
| cl_input.c | ||
| cl_keys.c | ||
| cl_main.c | ||
| cl_net_chan.c | ||
| cl_parse.c | ||
| cl_scrn.c | ||
| cl_ui.c | ||
| client.h | ||
| keycodes.h | ||
| keys.h | ||
| libmumblelink.c | ||
| libmumblelink.h | ||
| qal.c | ||
| qal.h | ||
| snd_adpcm.c | ||
| snd_codec.c | ||
| snd_codec.h | ||
| snd_codec_ogg.c | ||
| snd_codec_opus.c | ||
| snd_codec_wav.c | ||
| snd_dma.c | ||
| snd_local.h | ||
| snd_main.c | ||
| snd_mem.c | ||
| snd_mix.c | ||
| snd_openal.c | ||
| snd_public.h | ||
| snd_wavelet.c | ||