minetest-mirrors
/
advtrains
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix access control to wagon properties 

Previously, players were able to open the wagon properties of any wagon at all
through the wagon properties button on the inventory formspec and through the
wagon buttons on the onboard computer. Add a check for ownership before
allowing players to open wagon properties.
master
Blockhead 2020-06-28 23:39:32 +10:00 committed by Gabriel Pérez-Cerezo
parent 0b14d8ddb1
commit eb2e5f4cdf
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
advtrains/wagons.lua
View File

@ -921,7 +921,7 @@ function wagon:handle_bordcom_fields(pname, formname, fields)
advtrains.safe_decouple_wagon(tpid, pname)
elseif fields["wgprp"..i] then
for _,wagon in pairs(minetest.luaentities) do
if wagon.is_wagon and wagon.initialized and wagon.id==tpid then
if wagon.is_wagon and wagon.initialized and wagon.id==tpid and data.owner==pname then
wagon:show_wagon_properties(pname)
return
end
@ -1029,7 +1029,7 @@ minetest.register_on_player_receive_fields(function(player, formname, fields)
local data = advtrains.wagons[uid]
if fields.prop and data.owner==pname then
for _,wagon in pairs(minetest.luaentities) do
if wagon.is_wagon and wagon.initialized and wagon.id==uid then
if wagon.is_wagon and wagon.initialized and wagon.id==uid and data.owner==pname then
wagon:show_wagon_properties(pname)
--wagon:handle_bordcom_fields(player:get_player_name(), formname, fields)
end