Annikka/evennia
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Changed default permission of objects so as to not have 'control' permission of themselves. As user Kelketek pointed out, this could be a possible exploit. At any rate there is no need for objects to have control of themselves.

Browse source
This commit is contained in:
Griatch 2012-08-18 20:20:42 +02:00
parent a2e7246d15
commit 327cfc5098
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/objects/objects.py
View file

@ -390,7 +390,7 @@ class Object(TypeClass):
dbref = self.dbobj.dbref dbref = self.dbobj.dbref
self.locks.add("control:id(%s) or perm(Immortals)" % dbref) # edit locks/permissions, delete self.locks.add("control:perm(Immortals)") # edit locks/permissions, delete
self.locks.add("examine:perm(Builders)") # examine properties self.locks.add("examine:perm(Builders)") # examine properties
self.locks.add("view:all()") # look at object (visibility) self.locks.add("view:all()") # look at object (visibility)
self.locks.add("edit:perm(Wizards)") # edit properties/attributes self.locks.add("edit:perm(Wizards)") # edit properties/attributes