From 4c2302ec6ca25c2b9ac8592cf45a5d209b886b0b Mon Sep 17 00:00:00 2001 From: a1batross Date: Wed, 20 May 2026 01:03:03 +0500 Subject: [PATCH] engine: pass customization file fragments into IsSafeFileToDownload This function already validates customization filenames. --- engine/common/net_chan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/engine/common/net_chan.c b/engine/common/net_chan.c index 6c3bc126..33e651d5 100644 --- a/engine/common/net_chan.c +++ b/engine/common/net_chan.c @@ -1244,7 +1244,7 @@ qboolean Netchan_CopyFileFragments( netchan_t *chan, sizebuf_t *msg ) Netchan_FlushIncoming( chan, FRAG_FILE_STREAM ); return false; } - else if( filename[0] != '!' && ( COM_CheckNastyPath( filename ) || !COM_IsSafeFileToDownload( filename ))) + else if( COM_CheckNastyPath( filename ) || !COM_IsSafeFileToDownload( filename )) { Con_Printf( S_ERROR "file fragment received with bad path, ignoring\n" ); Netchan_FlushIncoming( chan, FRAG_FILE_STREAM );