mirror of
https://github.com/Cockatrice/Cockatrice.git
synced 2026-09-21 09:05:10 -07:00
cmdReplaySubmitCode dereferenced userInfo without an authentication guard, allowing an unauthenticated connection with a valid replay code to segfault the server. Add the same authState != PasswordRight guard used by all other replay handlers, and gate session command dispatch on a pre-auth whitelist so future handlers cannot be reached before login. Took 2 minutes Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de> |
||
|---|---|---|
| .. | ||
| client | ||
| server | ||