From d0abe049261a7a07e09e9d7e23a4dcd233813c2e Mon Sep 17 00:00:00 2001 From: thilo Date: Sun, 28 May 2006 14:36:37 +0000 Subject: Prevent servers from making clients download files that are written to non-quake3 directories. git-svn-id: svn://svn.icculus.org/quake3/trunk@790 edf5b092-35ff-0310-97b2-ce42778d08ea --- code/client/cl_main.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/code/client/cl_main.c b/code/client/cl_main.c index 9a1bcf6..da5d116 100644 --- a/code/client/cl_main.c +++ b/code/client/cl_main.c @@ -1443,6 +1443,13 @@ void CL_NextDownload(void) { *s++ = 0; else s = localName + strlen(localName); // point at the nul byte + + // Make sure the server cannot make us write to non-quake3 directories. + if(strstr(localName, "../")) + { + Com_Error(ERR_DROP, "CL_NextDownload: Invalid download name %s", localName); + return; + } CL_BeginDownload( localName, remoteName ); -- cgit v1.2.3