Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes maintainer access to the profiler and clears profiler access whenever admins are loaded. #7909

Merged
merged 7 commits into from
Jan 13, 2025

Conversation

Watermelon914
Copy link
Contributor

@Watermelon914 Watermelon914 commented Dec 25, 2024

About the pull request

As explained by the title.

Explain why it's good for the game

Prevents a vulnerability where someone who previously had access to the profiler retains access despite no longer requiring it.

No player facing change so changelog not needed

@cmss13-ci cmss13-ci bot added the Missing Changelog Maintainers always document their changes. label Dec 25, 2024
@Watermelon914 Watermelon914 added Fix Fix one bug, make ten more and removed Missing Changelog Maintainers always document their changes. labels Dec 25, 2024
@cmss13-ci cmss13-ci bot added the Missing Changelog Maintainers always document their changes. label Dec 25, 2024
cm13-github added a commit that referenced this pull request Dec 25, 2024
cm13-github added a commit that referenced this pull request Dec 25, 2024
Copy link
Contributor

@Drulikar Drulikar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not understand why on event server this works (after a reconnect - not first connect); but not on live (even with reconnects). I can confirm for both servers the cfg/admin.txt is assigned to be some_ckey role=admin for only those who have connected this round, and the perms for the file are the same for both servers.

But the aspect of requiring a reconnect is wonky as is. So try setting up the admin.txt during init (e.g. after load_admin_ranks) rather than on associate?

@Watermelon914
Copy link
Contributor Author

I do not understand why on event server this works (after a reconnect - not first connect); but not on live (even with reconnects). I can confirm for both servers the cfg/admin.txt is assigned to be some_ckey role=admin for only those who have connected this round, and the perms for the file are the same for both servers.

But the aspect of requiring a reconnect is wonky as is. So try setting up the admin.txt during init (e.g. after load_admin_ranks) rather than on associate?

I was doing testing with harryob, and the admin.txt was getting populated with ckeys. The problem isn't related to code, it's related to the cm-live server and it's unclear what might be causing it. In any case, this PR is still useful to merge since it clears up a potential vulnerability where people stay in the admin.txt despite probably not being an admin anymore.

cm13-github added a commit that referenced this pull request Dec 27, 2024
cm13-github added a commit that referenced this pull request Dec 27, 2024
@Watermelon914 Watermelon914 marked this pull request as ready for review December 28, 2024 17:04
cm13-github added a commit that referenced this pull request Jan 7, 2025
cm13-github added a commit that referenced this pull request Jan 7, 2025
cm13-github added a commit that referenced this pull request Jan 7, 2025
cm13-github added a commit that referenced this pull request Jan 7, 2025
cm13-github added a commit that referenced this pull request Jan 7, 2025
cm13-github added a commit that referenced this pull request Jan 7, 2025
cm13-github added a commit that referenced this pull request Jan 8, 2025
cm13-github added a commit that referenced this pull request Jan 8, 2025
cm13-github added a commit that referenced this pull request Jan 8, 2025
cm13-github added a commit that referenced this pull request Jan 10, 2025
@hry-gh hry-gh added this pull request to the merge queue Jan 13, 2025
Merged via the queue into cmss13-devs:master with commit 31a3b39 Jan 13, 2025
29 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Fix Fix one bug, make ten more Missing Changelog Maintainers always document their changes.
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

3 participants