jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-09-29 17:32:17 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

[Server/Client/Protocol] Address PR #7091 review: security, bug, and perf fixes

Browse source 
Security:
- Promote RESET_USER_PASSWORD to admin-only dispatch (was moderator-accessible)
- Reject password reset on users with equal/higher privilege than caller
- Notify affected user via Event_NotifyUser::CUSTOM when password is reset
- Add server-side category whitelist for reports
- Drop reporter name fallback in comment/details authorization (ID-only)
- Force password change: new DB column + login enforcement + client disconnect

Bugs:
- XSS via QTextEdit::append() → insertPlainText() in report tab and utils
- allNotified initialized to true even with empty recipients list
- Warning combo box: use currentData() instead of baked-in display text
- Report resolution now records who resolved (resolved_by column + audit)

Performance:
- IP-correlation subquery: add 6-month window + LIMIT 200
- getUserSessions: clamp limit to 500

Non-blocking:
- Palette-aware colors in report_utils.cpp (dark/light mode)
- Report list pagination: offset/limit fields + total_count in response
- SessionCommand enum gap comment for reserved values 1201-1203

Schema: 36→37 (force_password_change), 37→38 (resolved_by)

Took 12 minutes


Took 16 seconds
This commit is contained in:
Lukas Brübach 2026-08-20 11:15:15 +02:00
parent c6d8bce81f
commit f7998deb7a
18 changed files with 181 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

36
cockatrice/src/interface/widgets/tabs/tab_report.cpp
View file

@ -20,6 +20,7 @@
#include <QSignalBlocker>
#include <QSplitter>
#include <QTableWidget>
#include <QTextCursor>
#include <QTextEdit>
#include <QTimer>
#include <QVBoxLayout>
@ -835,12 +836,13 @@ void TabReport::userInfoResponse(const Response &response)
for (int i = 0; i < resp.recent_reports_size(); ++i) {
const ServerInfo_Report &r = resp.recent_reports(i);
QDateTime dt = QDateTime::fromSecsSinceEpoch(r.report_time());
userContextRecentReports->append(QString("[%1] #%2 by %3 [%4]: %5")
.arg(dt.toString("yyyy-MM-dd"))
.arg(r.report_id())
.arg(QString::fromStdString(r.reporter_name()))
.arg(QString::fromStdString(r.status()))
.arg(QString::fromStdString(r.category())));
userContextRecentReports->moveCursor(QTextCursor::End);
userContextRecentReports->insertPlainText(QString("[%1] #%2 by %3 [%4]: %5\n")
.arg(dt.toString("yyyy-MM-dd"))
.arg(r.report_id())
.arg(QString::fromStdString(r.reporter_name()))
.arg(QString::fromStdString(r.status()))
.arg(QString::fromStdString(r.category())));
}
}
}
@ -894,26 +896,32 @@ void TabReport::statsResponse(const Response &response)
statsCategoriesLabel->setText(tr("By category:"));
statsDetailText->clear();
statsDetailText->append(tr("=== Top Categories ==="));
statsDetailText->moveCursor(QTextCursor::End);
statsDetailText->insertPlainText(tr("=== Top Categories ===") + "\n");
for (int i = 0; i < resp.category_counts_size(); ++i) {
const ReportCategoryCount &cc = resp.category_counts(i);
QString cat = QString::fromStdString(cc.category());
cat.replace('_', ' ');
cat = cat.left(1).toUpper() + cat.mid(1);
statsDetailText->append(QString(" %1: %2").arg(cat).arg(cc.count()));
statsDetailText->moveCursor(QTextCursor::End);
statsDetailText->insertPlainText(QString(" %1: %2\n").arg(cat).arg(cc.count()));
}
statsDetailText->append(tr("\n=== Most Reported Users ==="));
statsDetailText->moveCursor(QTextCursor::End);
statsDetailText->insertPlainText("\n" + tr("=== Most Reported Users ===") + "\n");
for (int i = 0; i < resp.top_reported_users_size(); ++i) {
const ReportTopUser &tu = resp.top_reported_users(i);
statsDetailText->append(
QString(" %1: %2 reports").arg(QString::fromStdString(tu.user_name())).arg(tu.count()));
statsDetailText->moveCursor(QTextCursor::End);
statsDetailText->insertPlainText(
QString(" %1: %2 reports\n").arg(QString::fromStdString(tu.user_name())).arg(tu.count()));
}
statsDetailText->append(tr("\n=== Top Reporters ==="));
statsDetailText->moveCursor(QTextCursor::End);
statsDetailText->insertPlainText("\n" + tr("=== Top Reporters ===") + "\n");
for (int i = 0; i < resp.top_reporters_size(); ++i) {
const ReportTopUser &tu = resp.top_reporters(i);
statsDetailText->append(
QString(" %1: %2 reports filed").arg(QString::fromStdString(tu.user_name())).arg(tu.count()));
statsDetailText->moveCursor(QTextCursor::End);
statsDetailText->insertPlainText(
QString(" %1: %2 reports filed\n").arg(QString::fromStdString(tu.user_name())).arg(tu.count()));
}
}