fix: security vulnerabilities

Tested that all functions related to the touched files work

will test sqlite on a CI build
This commit is contained in:
David Markowitz
2026-06-06 23:13:09 -07:00
parent 8e09ffd6e8
commit fb166bd24d
107 changed files with 786 additions and 512 deletions

View File

@@ -7,9 +7,14 @@
void Binoculars::OnUse(Entity* self, Entity* user) {
const auto number = self->GetVarAsString(u"number");
int32_t flag = std::stoi(std::to_string(Game::server->GetZoneID()).substr(0, 2) + number);
if (user->GetCharacter()->GetPlayerFlag(flag) == false) {
user->GetCharacter()->SetPlayerFlag(flag, true);
const int32_t flag = GeneralUtils::TryParse(std::to_string(Game::server->GetZoneID()).substr(0, 2) + number, 0);
GameMessages::GetFlag flagMsg;
flagMsg.target = user->GetObjectID();
flagMsg.flagID = flag;
flagMsg.Send();
if (!flagMsg.flag) {
auto* const character = user->GetCharacter();
if (character) character->SetPlayerFlag(flag, true);
GameMessages::SendFireEventClientSide(self->GetObjectID(), user->GetSystemAddress(), u"achieve", LWOOBJID_EMPTY, 0, -1, LWOOBJID_EMPTY);
}
}

View File

@@ -33,14 +33,18 @@ void StoryBoxInteractServer::OnUse(Entity* self, Entity* user) {
const auto storyText = self->GetVarAsString(u"storyText");
if (storyText.length() > 2) {
auto storyValue = GeneralUtils::TryParse<uint32_t>(storyText.substr(storyText.length() - 2));
if(!storyValue) return;
if (!storyValue) return;
int32_t boxFlag = self->GetVar<int32_t>(u"altFlagID");
if (boxFlag <= 0) {
boxFlag = (10000 + Game::server->GetZoneID() + storyValue.value());
}
if (user->GetCharacter()->GetPlayerFlag(boxFlag) == false) {
user->GetCharacter()->SetPlayerFlag(boxFlag, true);
GameMessages::GetFlag flagMsg;
flagMsg.target = user->GetObjectID();
flagMsg.flagID = boxFlag;
flagMsg.Send();
if (!flagMsg.flag) {
auto* const character = user->GetCharacter();
if (character) user->GetCharacter()->SetPlayerFlag(boxFlag, true);
GameMessages::SendFireEventClientSide(self->GetObjectID(), user->GetSystemAddress(), u"achieve", LWOOBJID_EMPTY, 0, -1, LWOOBJID_EMPTY);
}
}