zdoom/qzdoom
0
0
Fork 0
mirror of https://github.com/ZDoom/qzdoom.git synced 2024-11-28 15:02:01 +00:00
Code Issues Projects Releases Packages Wiki Activity

- do not allow outside access to the variable storing the CCMD for OptionMenuItemCommand.

Browse source 
This can be abused to execute atbitrary commands from inside script code.
This commit is contained in:
Christoph Oelckers 2017-12-13 22:14:30 +01:00
parent 6b42036eb6
commit f3ac82e112
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
wadsrc/static/zscript/menu/optionmenuitems.txt
View file

@ -126,9 +126,12 @@ class OptionMenuItemSubmenu : OptionMenuItem
class OptionMenuItemCommand : OptionMenuItemSubmenu class OptionMenuItemCommand : OptionMenuItemSubmenu
{ {
private String ccmd; // do not allow access to this from the outside.
OptionMenuItemCommand Init(String label, Name command, bool centered = false) OptionMenuItemCommand Init(String label, Name command, bool centered = false)
{ {
Super.Init(label, command, 0, centered); Super.Init(label, command, 0, centered);
ccmd = command;
return self; return self;
} }
@ -146,7 +149,7 @@ class OptionMenuItemCommand : OptionMenuItemSubmenu
if (m.GetItem(mAction) != self) return false; if (m.GetItem(mAction) != self) return false;
} }
Menu.MenuSound("menu/choose"); Menu.MenuSound("menu/choose");
DoCommand(mAction); DoCommand(ccmd);
return true; return true;
} }