edshot99/ulib
1
0
Fork 0
forked from TeamUlysses/ulib
Code Pull Requests Activity

Security fix for executing server-side commands via ban reasons.

Browse Source
This commit is contained in:
SticklyMan 2015-01-04 01:52:05 -07:00
parent 27af3dce92
commit bb0c8a8bd6
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
lua/ulib/server/player.lua
View File

@ -188,6 +188,9 @@ function ULib.addBan( steamid, time, reason, name, admin )
end
end
-- Remove all semicolons from the reason to prevent command injection
showReason = string.gsub(showReason, ";", "")
-- This redundant kick code is to ensure they're kicked -- even if they're joining
game.ConsoleCommand( string.format( "kickid %s %s\n", steamid, showReason or "" ) )
game.ConsoleCommand( string.format( "banid %f %s kick\n", time, steamid ) )