Skip to content
Snippets Groups Projects
Commit d0be8238 authored by Kahrl's avatar Kahrl
Browse files

Always escape user provided data in mainmenu fields

parent 2fd3d520
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
builtin/mainmenu/tab_multiplayer.lua
+ 6
− 3
View file @ d0be8238
......@@ -24,8 +24,10 @@ local function get_formspec(tabview, name, tabdata)
"label[1,-0.25;".. fgettext("Favorites:") .. "]"..
"label[1,4.25;".. fgettext("Address/Port") .. "]"..
"label[9,2.75;".. fgettext("Name/Password") .. "]" ..
"field[1.25,5.25;5.5,0.5;te_address;;" ..core.setting_get("address") .."]" ..
"field[6.75,5.25;2.25,0.5;te_port;;" ..core.setting_get("remote_port") .."]" ..
"field[1.25,5.25;5.5,0.5;te_address;;" ..
core.formspec_escape(core.setting_get("address")) .."]" ..
"field[6.75,5.25;2.25,0.5;te_port;;" ..
core.formspec_escape(core.setting_get("remote_port")) .."]" ..
"checkbox[1,3.6;cb_public_serverlist;".. fgettext("Public Serverlist") .. ";" ..
dump(core.setting_getbool("public_serverlist")) .. "]"
......@@ -36,7 +38,8 @@ local function get_formspec(tabview, name, tabdata)
retval = retval ..
"button[9,4.95;2.5,0.5;btn_mp_connect;".. fgettext("Connect") .. "]" ..
"field[9.3,3.75;2.5,0.5;te_name;;" ..core.setting_get("name") .."]" ..
"field[9.3,3.75;2.5,0.5;te_name;;" ..
core.formspec_escape(core.setting_get("name")) .."]" ..
"pwdfield[9.3,4.5;2.5,0.5;te_pwd;]" ..
"textarea[9.3,0.25;2.5,2.75;;"
......
builtin/mainmenu/tab_server.lua
+ 4
− 4
View file @ d0be8238
......@@ -36,20 +36,20 @@ local function get_formspec(tabview, name, tabdata)
"checkbox[0.5,1.15;cb_server_announce;".. fgettext("Public") .. ";" ..
dump(core.setting_getbool("server_announce")) .. "]"..
"field[0.8,3.2;3.5,0.5;te_playername;".. fgettext("Name") .. ";" ..
core.setting_get("name") .. "]" ..
core.formspec_escape(core.setting_get("name")) .. "]" ..
"pwdfield[0.8,4.2;3.5,0.5;te_passwd;".. fgettext("Password") .. "]"
local bind_addr = core.setting_get("bind_address")
if bind_addr ~= nil and bind_addr ~= "" then
retval = retval ..
"field[0.8,5.2;2.25,0.5;te_serveraddr;".. fgettext("Bind Address") .. ";" ..
core.setting_get("bind_address") .."]" ..
core.formspec_escape(core.setting_get("bind_address")) .."]" ..
"field[3.05,5.2;1.25,0.5;te_serverport;".. fgettext("Port") .. ";" ..
core.setting_get("port") .."]"
core.formspec_escape(core.setting_get("port")) .."]"
else
retval = retval ..
"field[0.8,5.2;3.5,0.5;te_serverport;".. fgettext("Server Port") .. ";" ..
core.setting_get("port") .."]"
core.formspec_escape(core.setting_get("port")) .."]"
end
retval = retval ..
......
builtin/mainmenu/tab_simple_main.lua
+ 6
− 3
View file @ d0be8238
......@@ -23,14 +23,17 @@ local function get_formspec(tabview, name, tabdata)
retval = retval ..
"label[8,0.5;".. fgettext("Name/Password") .. "]" ..
"field[0.25,3.25;5.5,0.5;te_address;;" ..core.setting_get("address") .."]" ..
"field[5.75,3.25;2.25,0.5;te_port;;" ..core.setting_get("remote_port") .."]" ..
"field[0.25,3.25;5.5,0.5;te_address;;" ..
core.formspec_escape(core.setting_get("address")) .."]" ..
"field[5.75,3.25;2.25,0.5;te_port;;" ..
core.formspec_escape(core.setting_get("remote_port")) .."]" ..
"checkbox[8,-0.25;cb_public_serverlist;".. fgettext("Public Serverlist") .. ";" ..
render_details .. "]"
retval = retval ..
"button[8,2.5;4,1.5;btn_mp_connect;".. fgettext("Connect") .. "]" ..
"field[8.75,1.5;3.5,0.5;te_name;;" ..core.setting_get("name") .."]" ..
"field[8.75,1.5;3.5,0.5;te_name;;" ..
core.formspec_escape(core.setting_get("name")) .."]" ..
"pwdfield[8.75,2.3;3.5,0.5;te_pwd;]"
--favourites
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment