Skip to content
Snippets Groups Projects
  1. Dec 09, 2018
  2. Nov 06, 2018
  3. Oct 29, 2018
  4. Sep 18, 2018
    • luk3yx's avatar
      Mark 'code' as private as well · 028c290c
      luk3yx authored
      Saves on bandwidth, however the code is still accessible via the formspec.
      028c290c
    • luk3yx's avatar
      Mark LuaController memory as private · 8808bb89
      luk3yx authored
      If LuaControllers handle sensitive information, hacked clients could get this information from the LuaController. Marking the memory as private fixes this and saves a small amount of bandwidth.
      8808bb89
  5. Sep 08, 2018
  6. Sep 07, 2018
  7. Aug 28, 2018
  8. Aug 26, 2018
  9. Jul 24, 2018
  10. Jul 23, 2018
  11. Jul 21, 2018
  12. Jul 18, 2018
  13. May 15, 2018
  14. Mar 25, 2018
  15. Feb 15, 2018
  16. Jan 30, 2018
  17. Jan 28, 2018
  18. Jan 22, 2018
    • 20kdc's avatar
      Improve LuaController security (#393) · 065e8703
      20kdc authored
      Fixes:
      1. Lack of 'safe' on minetest.deserialize usage
      2. String sandbox bypass via (""):evil()
      3. Loss of upcoming digilines messages on server shutdown
      4. LCs failing to show information on some errors
      5. Interrupt IDs as infinite data storage
      065e8703
  19. Jan 18, 2018
  20. Jan 14, 2018
  21. Jan 13, 2018
    • Christopher Head's avatar
      Limit and optimize digiline_send (#379) · 2b096f05
      Christopher Head authored
      * Close vulnerability and optimize digiline_send
      
      `digiline_send` as it previously existed was vulnerable to a
      time-of-check-to-time-of-use vulnerability in which a table could be
      sent, size-checked, and then modified after the send but before
      delivery. This would allow larger tables to be sent. It was also slow
      because it called `minetest.serialize`. Fix both of these by
      implementing custom message cleanup logic which simultaneously computes
      the message’s cost.
      
      * Clean up interaction with Digilines
      
      Use `minetest.global_exists` to avoid an undefined global variable
      warning when operating a Luacontroller with Digilines not available. Use
      the new `digilines` table in preference to the old `digiline` table.
      
      * Copy received messages
      
      When a Digiline message is received at a Luacontroller, copy it so that
      local modifications made by the Luacontroller code will not modify
      copies of the table that are being passed to other nodes on the Digiline
      network.
      2b096f05
  22. Jan 06, 2018
  23. Oct 31, 2017
  24. Oct 29, 2017
  25. Oct 21, 2017
  26. Oct 18, 2017
  27. Oct 15, 2017
  28. Oct 08, 2017
Loading