Bug #2269 » 0065-Allow-hack-access-users-to-load-savegame-with-plain-.patch
| server/srv_main.c | ||
|---|---|---|
|
/* Try to load a saved game */
|
||
|
if ('\0' == srvarg.load_filename[0]
|
||
|
|| !load_command(nullptr, srvarg.load_filename, FALSE, TRUE)) {
|
||
|
|| !load_command(nullptr, srvarg.load_filename, FALSE)) {
|
||
|
/* Savegame not loaded */
|
||
|
sz_strlcpy(game.server.orig_game_version, freeciv_datafile_version());
|
||
| server/stdinhand.c | ||
|---|---|---|
|
legitimate but has inconsistencies) and would lead to a broken server
|
||
|
afterwards.
|
||
|
**************************************************************************/
|
||
|
bool load_command(struct connection *caller, const char *filename, bool check,
|
||
|
bool cmdline_load)
|
||
|
bool load_command(struct connection *caller, const char *filename, bool check)
|
||
|
{
|
||
|
struct timer *loadtimer, *uloadtimer;
|
||
|
struct section_file *file;
|
||
| ... | ... | |
|
const char **ext, *found = nullptr;
|
||
|
const struct strvec **path;
|
||
|
if (cmdline_load) {
|
||
|
/* Allow plain names being loaded with '--file' option, but not otherwise
|
||
|
* (no loading of arbitrary files by unauthorized users)
|
||
|
if (!is_restricted(caller)) {
|
||
|
/* Allow plain names being loaded with '--file' option or hack access,
|
||
|
* but not otherwise (no loading of arbitrary files by unauthorized users)
|
||
|
* Iterate through ALL paths to check for file with plain name before
|
||
|
* looking any path with an extension, i.e., prefer plain name file
|
||
|
* in later directory over file with extension in name in earlier
|
||
| ... | ... | |
|
Security: There are some rudimentary checks in load_rulesets() to see
|
||
|
if this directory really is a viable ruleset directory. For public
|
||
|
servers, we check against directory redirection (is_safe_filename) and
|
||
|
servers, we check against directory redirection (is_safe_filename() ) and
|
||
|
other bad stuff in the directory name, and will only use directories
|
||
|
inside the data directories.
|
||
|
**************************************************************************/
|
||
| ... | ... | |
|
case CMD_SCENSAVE:
|
||
|
return scensave_command(caller, arg, check);
|
||
|
case CMD_LOAD:
|
||
|
return load_command(caller, arg, check, FALSE);
|
||
|
return load_command(caller, arg, check);
|
||
|
case CMD_METAPATCHES:
|
||
|
return metapatches_command(caller, arg, check);
|
||
|
case CMD_METACONN:
|
||
| server/stdinhand.h | ||
|---|---|---|
|
char *buf, size_t buflen);
|
||
|
bool load_command(struct connection *caller,
|
||
|
const char *filename, bool check, bool cmdline_load);
|
||
|
const char *filename, bool check);
|
||
|
bool start_command(struct connection *caller, bool check, bool notify);
|
||
|
void toggle_ai_player_direct(struct connection *caller,
|
||