vilyaem/Xrasher
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

engine: common: double check that resource starting with !MD5 doesn't have any extension

Browse source
This commit is contained in:
Alibek Omarov 2024-05-31 00:42:32 +03:00
parent 484e4cb225
commit 8ee430eda2
1 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
engine/common/common.c
View file

@ -900,7 +900,10 @@ qboolean COM_IsSafeFileToDownload( const char *filename )
if( !COM_CheckString( filename )) if( !COM_CheckString( filename ))
return false; return false;
if( !Q_strncmp( filename, "!MD5", 4 )) ext = COM_FileExtension( lwrfilename );
// only allow extensionless files that start with !MD5
if( !Q_strncmp( filename, "!MD5", 4 ) && ext[0] == 0 )
return true; return true;
Q_strnlwr( filename, lwrfilename, sizeof( lwrfilename )); Q_strnlwr( filename, lwrfilename, sizeof( lwrfilename ));
@ -923,8 +926,6 @@ qboolean COM_IsSafeFileToDownload( const char *filename )
if( Q_strlen( first ) != 4 ) if( Q_strlen( first ) != 4 )
return false; return false;
ext = COM_FileExtension( lwrfilename );
for( i = 0; i < ARRAYSIZE( file_exts ); i++ ) for( i = 0; i < ARRAYSIZE( file_exts ); i++ )
{ {
if( !Q_stricmp( ext, file_exts[i] )) if( !Q_stricmp( ext, file_exts[i] ))