From 9d4ac9bd9af4215f10dfaa9f8668af9a6555c3b2 Mon Sep 17 00:00:00 2001 From: Auke Kok Date: Wed, 6 Dec 2017 21:15:58 -0800 Subject: [PATCH] Fix books: enforce book ownership, strict access checking. Fixes #399 --- homedecor/books.lua | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/homedecor/books.lua b/homedecor/books.lua index a480d686..20b1e39b 100644 --- a/homedecor/books.lua +++ b/homedecor/books.lua @@ -156,13 +156,20 @@ for _, c in ipairs(bookcolors) do end minetest.register_on_player_receive_fields(function(player, form_name, fields) - if form_name ~= BOOK_FORMNAME or not fields.save then - return + if form_name ~= BOOK_FORMNAME then + return false end local player_name = player:get_player_name() local pos = player_current_book[player_name] - if not pos then return end + if not pos then + return true + end local meta = minetest.get_meta(pos) + local owner = meta:get_string("owner") + if owner ~= "" and player_name ~= owner or not fields.save then + player_current_book[player_name] = nil + return true + end meta:set_string("title", fields.title or "") meta:set_string("text", fields.text or "") meta:set_string("owner", player_name) @@ -171,6 +178,9 @@ minetest.register_on_player_receive_fields(function(player, form_name, fields) end minetest.log("action", S("@1 has written in a book (title: \"@2\"): \"@3\" at location @4", player:get_player_name(), fields.title, fields.text, minetest.pos_to_string(player:getpos()))) + + player_current_book[player_name] = nil + return true end) minetest.register_alias("homedecor:book", "homedecor:book_grey")