diff --git a/_en/items/node_drawtypes.md b/_en/items/node_drawtypes.md index c6f7e78..2cabe80 100644 --- a/_en/items/node_drawtypes.md +++ b/_en/items/node_drawtypes.md @@ -173,7 +173,7 @@ minetest.register_node("default:water_source", { -- ^ how far post_effect_color = {a=64, r=100, g=100, b=200}, - -- ^ color of screen when the player is submerged + -- ^ colour of screen when the player is submerged }) ``` diff --git a/_en/map/storage.md b/_en/map/storage.md index 457f1eb..88f8a18 100644 --- a/_en/map/storage.md +++ b/_en/map/storage.md @@ -99,7 +99,7 @@ This is useful in order to show the owner of the node or the status. `description` is used in ItemStack Metadata to override the description when hovering over the stack in an inventory. -You can use colors by encoding them with `minetest.colorize()`. +You can use colours by encoding them with `minetest.colorize()`. `owner` is a common key used to store the username of the player that owns the item or node. diff --git a/_en/players/formspecs.md b/_en/players/formspecs.md index 86eae62..38ba499 100644 --- a/_en/players/formspecs.md +++ b/_en/players/formspecs.md @@ -87,7 +87,7 @@ At the time of writing, formspec information begins on line 1765. ## Displaying Formspecs -Here is a generalized way to show a formspec: +Here is a generalised way to show a formspec: minetest.show_formspec(playername, formname, formspec) diff --git a/_en/quality/security.md b/_en/quality/security.md index b6a9843..00fb738 100644 --- a/_en/quality/security.md +++ b/_en/quality/security.md @@ -41,12 +41,6 @@ Here's some real code found in a mod: ```lua minetest.register_on_player_receive_fields(function(player, formname, fields) - -- Todo: fix security issue here - local name = player:get_player_name() - if formname ~= "mymod:fs" then - return - end - for key, field in pairs(fields) do local x,y,z = string.match(key, "goto_([%d-]+)_([%d-]+)_([%d-]+)") @@ -59,7 +53,7 @@ minetest.register_on_player_receive_fields(function(player, end ``` -Can you spot the issue? A malicious user could submit a formspec containing +Can you spot the problem? A malicious user could submit a formspec containing their own position values, allowing them to teleport to anywhere they wish to. This could even be automated using client modifications to essentially replicate the `/teleport` command with no need for a privilege.