[Plus Emulator] Bot Speech Exploit Fix

[Verted]

Hi RaGEZONE,
I recently came across an "exploit" that allows users to bypass the bad HTML filter on bot speech setup.
Normally for example <font size="200"> and </font> would be blocked, but by simply using <FONT SIZE="200"> and </FONT> in capitals, you can bypass the filter. I also believe you can work around it with other variations too like "FoNT" or "fOnT" - but I do not remember. 200 is not the font size limit, you can make it go much higher and take up the whole screen. I have not tested this with alot of other HTML, but I'm sure this could be used to do much more malicious things.

It is shown here:
https://image.prntscr.com/image/ZJLYy7V7QX_h5oRX5iIuhg.png




Here's the fix which completely removes any form of string upon saving bot speeches.

Go to SaveBotActionEvent.cs and find:

for (int i = 0; i <= SpeechData.Length - 1; i++)
                        {                             using (IQueryAdapter dbClient = DatabaseManager.GetQueryReactor())

Replace that with:

for (int i = 0; i <= SpeechData.Length - 1; i++)                        {
                            SpeechData[i] = Regex.Replace(SpeechData[i], "<(.|\\n)*?>", string.Empty);
                            using (IQueryAdapter dbClient = DatabaseManager.GetQueryReactor())

Happy days.

[MentaL]

[streamhotel]

This is old news. Already fixed clientside I thought. Which Habbo.swf revision you were using?

[Joopie]

This is old news. Already fixed clientside I thought. Which Habbo.swf revision you were using?

Fixing it serverside is always better than let the client handle stuff like this. It's oke as a first measurement against invalid input, but the server should always do it too!

[Verted]

This is old news. Already fixed clientside I thought. Which Habbo.swf revision you were using?

Plus Revision 2, not sure which production though. Can check this later if I can be fucked.

Fixing it serverside is always better than let the client handle stuff like this. It's oke as a first measurement against invalid input, but the server should always do it too!

True.

[The General]

Ever since bots were released this has been a issue on most emulators.

[Verted]

Ever since bots were released this has been a issue on most emulators.

No longer

[Oliveri]

No longer

Honestly, yes it is. You can still bypass the "protection" one way or another. Like in *rcturus it would be fixed with a simple while loop, but no one cares.

[DinamicUser]

I've tested this bug on Plus Emulator R2 by Sledmore and it are affect.

EDIT: Thank you for this fix.

[Gaby]

http://forum.ragezone.com/f353/mercu...ml#post8273713

2014