Fixed amb1815 - Custom admin menu wasn't escaping input
authorMatt Woodrow <pred@alliedmods.net>
Mon Jul 07 22:11:49 2008 +0000 (2008-07-07)
changeset 21776f1b08406d41
parent 2167 e94c33b3ceb4
child 2178 7769e1d56f64
Fixed amb1815 - Custom admin menu wasn't escaping input
plugins/adminmenu/dynamicmenu.sp
     1.1 --- a/plugins/adminmenu/dynamicmenu.sp	Sun Jul 06 03:37:40 2008 +0000
     1.2 +++ b/plugins/adminmenu/dynamicmenu.sp	Mon Jul 07 22:11:49 2008 +0000
     1.3 @@ -284,8 +284,7 @@
     1.4  					else
     1.5  					{
     1.6  						submenuInput[Submenu_method] = Name;
     1.7 -					}					
     1.8 -					
     1.9 +					}				
    1.10  				}
    1.11  				
    1.12  				KvGetString(kvMenu, "title", inputBuffer, sizeof(inputBuffer));
    1.13 @@ -586,13 +585,16 @@
    1.14  		
    1.15  		DisplayTopMenu(hAdminMenu, client, TopMenuPosition_LastCategory);
    1.16  		
    1.17 +		decl String:unquotedCommand[CMD_LENGTH];
    1.18 +		UnQuoteString(g_command[client], unquotedCommand, sizeof(unquotedCommand), "#@");
    1.19 +		
    1.20  		if (outputItem[Item_execute] == Execute_Player) // assume 'player' type execute option
    1.21  		{
    1.22 -			FakeClientCommand(client, g_command[client]);
    1.23 +			FakeClientCommand(client, unquotedCommand);
    1.24  		}
    1.25  		else // assume 'server' type execute option
    1.26  		{
    1.27 -			InsertServerCommand(g_command[client]);
    1.28 +			InsertServerCommand(unquotedCommand);
    1.29  			ServerExecute();
    1.30  		}
    1.31  
    1.32 @@ -610,16 +612,20 @@
    1.33  	
    1.34  	if (action == MenuAction_Select)
    1.35  	{
    1.36 -		new String:info[NAME_LENGTH];
    1.37 +		new String:unquotedinfo[NAME_LENGTH];
    1.38   
    1.39  		/* Get item info */
    1.40 -		new bool:found = GetMenuItem(menu, param2, info, sizeof(info));
    1.41 +		new bool:found = GetMenuItem(menu, param2, unquotedinfo, sizeof(unquotedinfo));
    1.42  		
    1.43  		if (!found)
    1.44  		{
    1.45  			return;
    1.46  		}
    1.47  		
    1.48 +		new String:info[NAME_LENGTH*2+1];
    1.49 +		QuoteString(unquotedinfo, info, sizeof(info), "#@");
    1.50 +		
    1.51 +		
    1.52  		new String:buffer[6];
    1.53  		new String:infobuffer[NAME_LENGTH+2];
    1.54  		Format(infobuffer, sizeof(infobuffer), "\"%s\"", info);
    1.55 @@ -643,4 +649,73 @@
    1.56  		//client exited we should go back to submenu i think
    1.57  		DisplayTopMenu(hAdminMenu, param1, TopMenuPosition_LastCategory);
    1.58  	}
    1.59 +}
    1.60 +
    1.61 +
    1.62 +stock bool:QuoteString(String:input[], String:output[], maxlen, String:quotechars[])
    1.63 +{
    1.64 +	new count = 0;
    1.65 +	new len = strlen(input);
    1.66 +	
    1.67 +	for (new i=0; i<len; i++)
    1.68 +	{
    1.69 +		output[count] = input[i];
    1.70 +		count++;
    1.71 +		
    1.72 +		if (count >= maxlen)
    1.73 +		{
    1.74 +			/* Null terminate for safety */
    1.75 +			output[maxlen-1] = 0;
    1.76 +			return false;	
    1.77 +		}
    1.78 +		
    1.79 +		if (FindCharInString(quotechars, input[i]) != -1 || input[i] == '\\')
    1.80 +		{
    1.81 +			/* This char needs escaping */
    1.82 +			output[count] = '\\';
    1.83 +			count++;
    1.84 +			
    1.85 +			if (count >= maxlen)
    1.86 +			{
    1.87 +				/* Null terminate for safety */
    1.88 +				output[maxlen-1] = 0;
    1.89 +				return false;	
    1.90 +			}		
    1.91 +		}
    1.92 +	}
    1.93 +	
    1.94 +	output[count] = 0;
    1.95 +	
    1.96 +	return true;
    1.97 +}
    1.98 +
    1.99 +stock bool:UnQuoteString(String:input[], String:output[], maxlen, String:quotechars[])
   1.100 +{
   1.101 +	new count = 1;
   1.102 +	new len = strlen(input);
   1.103 +	
   1.104 +	output[0] = input[0];
   1.105 +	
   1.106 +	for (new i=1; i<len; i++)
   1.107 +	{
   1.108 +		output[count] = input[i];
   1.109 +		count++;
   1.110 +		
   1.111 +		if (input[i+1] == '\\' && (input[i] == '\\' || FindCharInString(quotechars, input[i]) != -1))
   1.112 +		{
   1.113 +			/* valid quotechar followed by a backslash - Skip */
   1.114 +			i++; 
   1.115 +		}
   1.116 +		
   1.117 +		if (count >= maxlen)
   1.118 +		{
   1.119 +			/* Null terminate for safety */
   1.120 +			output[maxlen-1] = 0;
   1.121 +			return false;	
   1.122 +		}
   1.123 +	}
   1.124 +	
   1.125 +	output[count] = 0;
   1.126 +	
   1.127 +	return true;
   1.128  }
   1.129 \ No newline at end of file