From c190d49b4f9d211599475e5b8d09fbf3a862acfb Mon Sep 17 00:00:00 2001 From: Phillip Thelen Date: Fri, 27 Jun 2014 14:36:25 +0200 Subject: [PATCH] Check if items are owned before equipping This checks if the user actually owns the pet, mount or gear they are trying to equip. This also prevents users from setting things that do not exist. (before users could set the value for pets and mounts to any string. Not sure if this leaves possiblilities for xss attacks. but this fix also prevents that). --- script/index.coffee | 3 +++ 1 file changed, 3 insertions(+) diff --git a/script/index.coffee b/script/index.coffee index 2f2093d655..229d13d545 100644 --- a/script/index.coffee +++ b/script/index.coffee @@ -642,11 +642,14 @@ api.wrap = (user, main=true) -> [type, key] = [req.params.type || 'equipped', req.params.key] switch type when 'mount' + return cb?({code:404,message:":You do not own this mount."}) unless user.items.mounts[key] user.items.currentMount = if user.items.currentMount is key then '' else key when 'pet' + return cb?({code:404,message:":You do not own this pet."}) unless user.items.pets[key] user.items.currentPet = if user.items.currentPet is key then '' else key when 'costume','equipped' item = content.gear.flat[key] + return cb?({code:404,message:":You do not own this gear."}) unless user.items.gear.owned[key] if user.items.gear[type][item.type] is key user.items.gear[type][item.type] = "#{item.type}_base_0" message = i18n.t('messageUnEquipped', {itemText: item.text(req.language)}, req.language)