Skip to content

add/bugfix: Фикс сборки грифски, добавление в ботов доступа синдиката#8559

Open
dictor31 wants to merge 1 commit intoss220-space:master220from
dictor31:bugfix
Open

add/bugfix: Фикс сборки грифски, добавление в ботов доступа синдиката#8559
dictor31 wants to merge 1 commit intoss220-space:master220from
dictor31:bugfix

Conversation

@dictor31
Copy link
Contributor

@dictor31 dictor31 commented Mar 3, 2026

Что этот ПР делает

Доработка предыдущего ПРа - #8488

Тестирование

  • После настройки доступов на каркасе бипски, доступы не сбрасываются когда каркас становится каркасом грифски.
  • При проведении по каркасу бота картой с доступом агента синдиката - его доступ добавляется в бота. Т.е. любой человек с картой агента синдиката может его настраивать.

Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a mechanism for Syndicate agents to covertly add their access to bot assemblies, adding core functionality. A significant security flaw has been identified in the bot assembly's UI handling logic: the 'set' action in the TGUI interface lacks an authorization check. This allows any user to add or remove arbitrary access levels from the bot's control list, potentially leading to unauthorized control or hijacking of station bots. It is recommended to implement a fix to ensure users can only modify access levels they already possess. Additionally, there are opportunities for code improvement, such as addressing significant code duplication in the attackby method for ID cards in code/modules/mob/living/simple_animal/bot/construction.dm:20 and refining the set_agent_access procedure in code/modules/mob/living/simple_animal/bot/construction.dm:1052 to avoid using the global usr and to use more robust argument typing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant