add/bugfix: Фикс сборки грифски, добавление в ботов доступа синдиката#8559
add/bugfix: Фикс сборки грифски, добавление в ботов доступа синдиката#8559dictor31 wants to merge 1 commit intoss220-space:master220from
Conversation
There was a problem hiding this comment.
Code Review
This pull request introduces a mechanism for Syndicate agents to covertly add their access to bot assemblies, adding core functionality. A significant security flaw has been identified in the bot assembly's UI handling logic: the 'set' action in the TGUI interface lacks an authorization check. This allows any user to add or remove arbitrary access levels from the bot's control list, potentially leading to unauthorized control or hijacking of station bots. It is recommended to implement a fix to ensure users can only modify access levels they already possess. Additionally, there are opportunities for code improvement, such as addressing significant code duplication in the attackby method for ID cards in code/modules/mob/living/simple_animal/bot/construction.dm:20 and refining the set_agent_access procedure in code/modules/mob/living/simple_animal/bot/construction.dm:1052 to avoid using the global usr and to use more robust argument typing.
Что этот ПР делает
Доработка предыдущего ПРа - #8488
Тестирование