Fix vulnerability by checking privs in formspec callback

2017-12-04 16:49:17 +00:00 · 2017-12-04 16:49:17 +00:00 · 18a803c9a9
parent 701ec1f060
commit 18a803c9a9
1 changed files with 4 additions and 0 deletions
--- a/gui.lua
+++ b/gui.lua
@ -36,6 +36,10 @@ minetest.register_on_player_receive_fields(function(player, formname, fields)
 	if (formname~="privilegeareas:gui_add") then
 		return false
 	end
+		
+	if not minetest.check_player_privs(player, "privs") then
+		return false
+	end

 	if fields.submit then
 		-- Do addition stuff