RomkaZVO/xash3d-fwgs
1
0
Fork 0
mirror of https://github.com/FWGS/xash3d-fwgs.git synced 2026-08-05 03:24:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

engine: server: harden rcon, use constant time comparison, do not output untrusted data to log

Browse Source
This commit is contained in:
Alibek Omarov
2026-05-17 11:23:55 +05:00
parent dbe1a2742e
commit c2c781f039
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
engine/server/sv_client.c
View File

@@ -1041,7 +1041,7 @@ static qboolean Rcon_Validate( void )
{
if( COM_StringEmptyOrNULL( rcon_password.string ))
return false;
if( Q_strcmp( Cmd_Argv( 1 ), rcon_password.string ))
if( Q_strcmp_constant_time( Cmd_Argv( 1 ), rcon_password.string ))
return false;
return true;
}
@@ -1065,15 +1065,15 @@ void SV_RemoteCommand( netadr_t from, sizebuf_t *msg )
adr = NET_AdrToString( from );
Con_Printf( "Rcon from %s:\n%s\n", adr, MSG_GetData( msg ) + 4 );
Log_Printf( "Rcon: \"%s\" from \"%s\"\n", MSG_GetData( msg ) + 4, adr );
if( Rcon_Validate( ))
{
static char outputbuf[2048];
char remaining[1024];
char *p = remaining;
Con_Printf( "Rcon from %s:\n%s\n", adr, MSG_GetData( msg ) + 4 );
Log_Printf( "Rcon: \"%s\" from \"%s\"\n", MSG_GetData( msg ) + 4, adr );
remaining[0] = 0;
for( i = 2; i < Cmd_Argc(); i++ )
{
@@ -1086,7 +1086,11 @@ void SV_RemoteCommand( netadr_t from, sizebuf_t *msg )
Cmd_ExecuteString( remaining );
SV_EndRedirect( &host.rd );
}
else Con_Printf( S_ERROR "Bad rcon_password.\n" );
else
{
Con_Printf( S_ERROR "Bad rcon_password from %s\n", adr );
Log_Printf( "Bad Rcon from \"%s\"\n", adr );
}
}
/*