Project

General

Profile

Download (4.22 KB)

Bug #2269 » 0034-Allow-hack-access-users-to-load-savegame-with-plain-.patch

S3_3, S3_2 - Marko Lindqvist, 09/21/2026 10:00 PM

View differences:

server/srv_main.c
/* Try to load a saved game */
if ('\0' == srvarg.load_filename[0]
|| !load_command(NULL, srvarg.load_filename, FALSE, TRUE)) {
|| !load_command(NULL, srvarg.load_filename, FALSE)) {
/* Savegame not loaded */
sz_strlcpy(game.server.orig_game_version, freeciv_datafile_version());
server/stdinhand.c
legitimate but has inconsistencies) and would lead to a broken server
afterwards.
**************************************************************************/
bool load_command(struct connection *caller, const char *filename, bool check,
bool cmdline_load)
bool load_command(struct connection *caller, const char *filename, bool check)
{
struct timer *loadtimer, *uloadtimer;
struct section_file *file;
......
const char **ext, *found = NULL;
const struct strvec **path;
if (cmdline_load) {
/* Allow plain names being loaded with '--file' option, but not otherwise
* (no loading of arbitrary files by unauthorized users)
if (!is_restricted(caller)) {
/* Allow plain names being loaded with '--file' option or hack access,
* but not otherwise (no loading of arbitrary files by unauthorized users)
* Iterate through ALL paths to check for file with plain name before
* looking any path with an extension, i.e., prefer plain name file
* in later directory over file with extension in name in earlier
......
Security: There are some rudimentary checks in load_rulesets() to see
if this directory really is a viable ruleset directory. For public
servers, we check against directory redirection (is_safe_filename) and
servers, we check against directory redirection (is_safe_filename() ) and
other bad stuff in the directory name, and will only use directories
inside the data directories.
**************************************************************************/
......
case CMD_SCENSAVE:
return scensave_command(caller, arg, check);
case CMD_LOAD:
return load_command(caller, arg, check, FALSE);
return load_command(caller, arg, check);
case CMD_METAPATCHES:
return metapatches_command(caller, arg, check);
case CMD_METAMESSAGE:
server/stdinhand.h
char *buf, size_t buflen);
bool load_command(struct connection *caller,
const char *filename, bool check, bool cmdline_load);
const char *filename, bool check);
bool start_command(struct connection *caller, bool check, bool notify);
void toggle_ai_player_direct(struct connection *caller,
(2-2/2)