> Attention ANYONE WHO USES ASCII PFILES!
>
> A major back door has just been found. It was exploited on my MUD, I
> finally discovered how it was done.
>
> Using this bug a player can take control of the MUD totally, wipe the imm
> char and replace it with their own version.
>
> reproduction snipped <
> The "solution" to this is to parse descriptions to be written to the
> file, replacing "~" with a blank space.
>
Couldn't you then simply insert a blank space in the reproduction where
the ~ was? And second, how will fread_string react if it can't find that
darn tilde, when it loads. Won't it keep going till it does find a tilde?
Is this solution tested? Not that i'm sure, but I think this
won't work.
Though it might be more difficult, you may want to write a
specific use function attached to the enhanced editor which would force
certain conventions on any person entering data... say one that would
search for a tilde and remove/replace them? Really, how often does one
use a tilde in a desc anyway?
10 seconds of thought at 3 am:
Make a flag, or some other setting - it won't be saved or
anything, so throw it in your player_special_data. I'll call mine
int use_tilde. In string_add, after the 'deletedoubledollar()' or
whatever sort of function that is, throw in a quick string altering
function, after a check like if (use_tilde).
quick, chicken scratch remove tilde function.
char *remove_tildes(char *string) {
char *ptr;
int done=0;
while(!done) {
if ((ptr = strchr(string,'~')) ! = NULL)
*ptr = ' ';
else
done++;
}
return string;
}
Just make sure to set the use_tilde to the correct value upon
entering the editing state, and to set it back when you're done. This
way, people can use tildes in room descriptions, mail, mobnames, what have
you, and you can protect the files.
Of course, I could be wrong.
PjD
+------------------------------------------------------------+
| Ensure that you have read the CircleMUD Mailing List FAQ: |
| http://democracy.queensu.ca/~fletcher/Circle/list-faq.html |
+------------------------------------------------------------+
This archive was generated by hypermail 2b30 : 12/15/00 PST