diff options
Diffstat (limited to 'src/client/cl_parse.c')
| -rw-r--r-- | src/client/cl_parse.c | 26 |
1 files changed, 24 insertions, 2 deletions
diff --git a/src/client/cl_parse.c b/src/client/cl_parse.c index dc14cd66..7de07e91 100644 --- a/src/client/cl_parse.c +++ b/src/client/cl_parse.c @@ -369,16 +369,38 @@ void CL_SystemInfoChanged( void ) { // scan through all the variables in the systeminfo and locally set cvars to match s = systemInfo; while ( s ) { + int cvar_flags; + Info_NextPair( &s, key, value ); if ( !key[0] ) { break; } + // ehw! - if ( !Q_stricmp( key, "fs_game" ) ) { + if (!Q_stricmp(key, "fs_game")) + { + if(FS_CheckDirTraversal(value)) + { + Com_Printf(S_COLOR_YELLOW "WARNING: Server sent invalid fs_game value %s\n", value); + continue; + } + gameSet = qtrue; } - Cvar_Set( key, value ); + if((cvar_flags = Cvar_Flags(key)) == CVAR_NONEXISTENT) + Cvar_Get(key, value, CVAR_SERVER_CREATED | CVAR_ROM); + else + { + // If this cvar may not be modified by a server discard the value. + if(!(cvar_flags & (CVAR_SYSTEMINFO | CVAR_SERVER_CREATED))) + { + Com_Printf(S_COLOR_YELLOW "WARNING: server is not allowed to set %s=%s\n", key, value); + continue; + } + + Cvar_Set(key, value); + } } // if game folder should not be set and it is set at the client side if ( !gameSet && *Cvar_VariableString("fs_game") ) { |