Skip to content
Snippets Groups Projects
  1. Mar 06, 2019
  2. Dec 29, 2018
  3. Dec 21, 2018
  4. Dec 09, 2018
  5. Nov 06, 2018
  6. Oct 29, 2018
  7. Oct 17, 2018
  8. Oct 12, 2018
  9. Oct 11, 2018
  10. Sep 18, 2018
    • luk3yx's avatar
      Mark 'code' as private as well · 028c290c
      luk3yx authored
      Saves on bandwidth, however the code is still accessible via the formspec.
      028c290c
    • luk3yx's avatar
      Mark LuaController memory as private · 8808bb89
      luk3yx authored
      If LuaControllers handle sensitive information, hacked clients could get this information from the LuaController. Marking the memory as private fixes this and saves a small amount of bandwidth.
      8808bb89
  11. Sep 08, 2018
  12. Sep 07, 2018
  13. Aug 28, 2018
  14. Aug 26, 2018
  15. Jul 24, 2018
  16. Jul 23, 2018
  17. Jul 21, 2018
  18. Jul 18, 2018
  19. May 15, 2018
  20. Mar 25, 2018
  21. Mar 14, 2018
  22. Feb 15, 2018
  23. Jan 30, 2018
  24. Jan 28, 2018
  25. Jan 22, 2018
    • 20kdc's avatar
      Improve LuaController security (#393) · 065e8703
      20kdc authored
      Fixes:
      1. Lack of 'safe' on minetest.deserialize usage
      2. String sandbox bypass via (""):evil()
      3. Loss of upcoming digilines messages on server shutdown
      4. LCs failing to show information on some errors
      5. Interrupt IDs as infinite data storage
      065e8703
  26. Jan 18, 2018
  27. Jan 14, 2018
  28. Jan 13, 2018
    • Christopher Head's avatar
      Limit and optimize digiline_send (#379) · 2b096f05
      Christopher Head authored
      * Close vulnerability and optimize digiline_send
      
      `digiline_send` as it previously existed was vulnerable to a
      time-of-check-to-time-of-use vulnerability in which a table could be
      sent, size-checked, and then modified after the send but before
      delivery. This would allow larger tables to be sent. It was also slow
      because it called `minetest.serialize`. Fix both of these by
      implementing custom message cleanup logic which simultaneously computes
      the message’s cost.
      
      * Clean up interaction with Digilines
      
      Use `minetest.global_exists` to avoid an undefined global variable
      warning when operating a Luacontroller with Digilines not available. Use
      the new `digilines` table in preference to the old `digiline` table.
      
      * Copy received messages
      
      When a Digiline message is received at a Luacontroller, copy it so that
      local modifications made by the Luacontroller code will not modify
      copies of the table that are being passed to other nodes on the Digiline
      network.
      2b096f05
  29. Jan 06, 2018
Loading