clear the rcon password on "connect" command or QW-style reconnect, to prevent stuffc...

[xonotic/darkplaces.git] / host_cmd.c

diff --git a/host_cmd.c b/host_cmd.c
index c8c7889673de61e38c6d88e1ab83f535b1d52c9e..6c051d9f0f8c0e83cc9715560619d9c83d2a8a1d 100644 (file)
--- a/host_cmd.c
+++ b/host_cmd.c
@@ -473,7 +473,11 @@ void Host_Reconnect_f (void)
                // will still contain its IP address, so get the address...
                InfoString_GetValue(cls.userinfo, "*ip", temp, sizeof(temp));
                if (temp[0])
+               {
+                       // clear the rcon password, to prevent vulnerability by stuffcmd-ing a setinfo command to change *ip, then reconnect
+                       Cvar_SetQuick(&rcon_password, "");
                        CL_EstablishConnection(temp);
+               }
                else
                        Con_Printf("Reconnect to what server?  (you have not connected to a server yet)\n");
                return;
@@ -525,6 +529,8 @@ void Host_Connect_f (void)
                Con_Print("connect <serveraddress> : connect to a multiplayer game\n");
                return;
        }
+       // clear the rcon password, to prevent vulnerability by stuffcmd-ing a connect command
+       Cvar_SetQuick(&rcon_password, "");
        CL_EstablishConnection(Cmd_Argv(1));
 }
 
@@ -2390,10 +2396,12 @@ void Host_Rcon_f (void) // credit: taken from QuakeWorld
                        char argbuf[1500];
                        dpsnprintf(argbuf, sizeof(argbuf), "%ld %s", (long) time(NULL), Cmd_Args());
                        memcpy(buf, "\377\377\377\377srcon HMAC-MD4 TIME ", 24);
-                       HMAC_MDFOUR_16BYTES((unsigned char *) (buf + 24), (unsigned char *) argbuf, strlen(argbuf), (unsigned char *) rcon_password.string, strlen(rcon_password.string));
-                       buf[40] = ' ';
-                       strlcpy(buf + 41, argbuf, sizeof(buf) - 41);
-                       NetConn_Write(mysocket, buf, 41 + strlen(buf + 41), &to);
+                       if(HMAC_MDFOUR_16BYTES((unsigned char *) (buf + 24), (unsigned char *) argbuf, strlen(argbuf), (unsigned char *) rcon_password.string, strlen(rcon_password.string)))
+                       {
+                               buf[40] = ' ';
+                               strlcpy(buf + 41, argbuf, sizeof(buf) - 41);
+                               NetConn_Write(mysocket, buf, 41 + strlen(buf + 41), &to);
+                       }
                }
                else
                {