minetest.git/src/script, branch 0.4.15 lizzy's patches for luanti https://git.vlhl.dev/lizzy/luanti/minetest.git/atom?h=0.4.15 2016-12-21T09:20:06+00:00 Fix warning reported by clang (possible bug in Settings lua api) 2016-12-21T09:20:06+00:00 sfan5 sfan5@live.de 2016-12-21T09:20:06+00:00 urn:sha1:cc7c31a5bc44ab0010997e86c0a8c9f5f832b398 Security: Fix resolving of some relative paths 2016-12-20T07:17:38+00:00 ShadowNinja shadowninja@minetest.net 2016-12-16T22:43:39+00:00 urn:sha1:0f0502109eac44128e87906fff30b5d049392f1d Trying to resolve a path with RemoveRelativePathComponents that can't be resolved without leaving leading parent components (e.g. "../worlds/foo" or "bar/../../worlds/foo") will fail. To work around this, we leave the relative components and simply remove the trailing components one at a time, and bail out when we find a parent component. This will still fail for paths like "worlds/foo/noexist/../auth.txt" (the path before the last parent component must not exist), but this is fine since you won't be able to open a file with a path like that anyways (the O.S. will determine that the path doesn't exist. Try `cat /a/../etc/passwd`). Mod security: Allow read-only access to all mod paths 2016-12-20T06:34:04+00:00 ShadowNinja shadowninja@minetest.net 2016-12-05T19:59:15+00:00 urn:sha1:59f84ca0a07e50dd5ce050d38ae1aeb529bd25ac Simple decorations: Fix range check for deco->deco_param2 2016-12-08T08:38:10+00:00 Auke Kok sofar@foo-projects.org 2016-12-07T06:08:16+00:00 urn:sha1:5a2431a9bd9a019a47cd279ac988435b075cdabe Allow any int value, and properly range check it before casting. Simple deco: Allow setting param2 value on placement 2016-12-07T04:17:17+00:00 Auke Kok sofar@foo-projects.org 2016-12-07T00:39:33+00:00 urn:sha1:2e69711613c18e1075f245d196823ea23675f027 Schematics can already be placed with a param2 value, but not simple 1-node plant decorations of the simple type. This adds a `param2` field to the simple deco type that is checked to be between 0 and 255, and put to the placed node at mapgen. This can be used to put a degrotate value in, or e.g. a fill value for leveltype nodes, or a place_param2 value at mapgen placement, or vary the shape of meshoptions plantlike drawtype. Allow restricting detached inventories to one player 2016-11-28T12:41:19+00:00 sfan5 sfan5@live.de 2016-11-26T16:35:25+00:00 urn:sha1:c38985825f299999135cc01aaf0052ec9138135a This combats the problem of sending the hundreds of "creative" / "armor" or whatever detached invs that exist on popular servers to each and every player on join or on change of said invs. Limit light_source in the engine (#4814) 2016-11-28T08:43:33+00:00 juhdanad juhdanad@gmail.com 2016-11-28T08:43:33+00:00 urn:sha1:2fe3bf5a18eb9aa9f38654b3c0a0729c42408cd6 Since light_source>15 causes crash, it must be limited. Fix secure io.lines 2016-11-24T15:10:20+00:00 ShadowNinja shadowninja@minetest.net 2016-11-24T15:10:20+00:00 urn:sha1:3af5eef96463510a27cf06b9c3ecc9f1d04cdac6 It used to drop all of the return values from the insecure version of the function. Fix secure io.open without mode 2016-11-24T14:58:21+00:00 ShadowNinja shadowninja@minetest.net 2016-11-24T14:58:21+00:00 urn:sha1:9e10f9f49a558050d36a49db619bf8f5eb3853c0 Revert "Adding particle blend, glow and animation (#4705)" 2016-11-14T14:28:06+00:00 sfan5 sfan5@live.de 2016-11-14T14:28:06+00:00 urn:sha1:5fd1ef9b589419e2464f5599ea47a2f28f4d7b7b This reverts commit 93e3555eae2deaeca69ee252cfa9cc9c3e0e49ef.