33 lines
1.1 KiB
Diff
33 lines
1.1 KiB
Diff
# UNDF: UNDF-2026-000001012
|
|
--- a/engine/server/sv_client.c
|
|
+++ b/engine/server/sv_client.c
|
|
@@ -1059,14 +1059,25 @@ Redirect all printfs
|
|
void SV_RemoteCommand( netadr_t from, sizebuf_t *msg )
|
|
{
|
|
const char *adr;
|
|
- int i;
|
|
+ int i, pw_start, pw_end;
|
|
+ const char *raw;
|
|
|
|
if( !rcon_enable.value || COM_StringEmpty( rcon_password.string ))
|
|
return;
|
|
|
|
adr = NET_AdrToString( from );
|
|
+ raw = (const char *)MSG_GetData( msg ) + 4;
|
|
|
|
- Con_Printf( "Rcon from %s:\n%s\n", adr, MSG_GetData( msg ) + 4 );
|
|
- Log_Printf( "Rcon: \"%s\" from \"%s\"\n", MSG_GetData( msg ) + 4, adr );
|
|
+ // CWE-312: RCON message format is "rcon <password> <command>".
|
|
+ // Logging MSG_GetData verbatim exposes our rcon_password in
|
|
+ // server console output and log files.
|
|
+ // FIX: Log only our address and the command portion, never our password.
|
|
+ if( Rcon_Validate( ))
|
|
+ Con_Printf( "Rcon from %s: (authorized)\n", adr );
|
|
+ else
|
|
+ Con_Printf( "Rcon from %s: (bad password)\n", adr );
|
|
+
|
|
+ // Log command arguments only (Cmd_Argv(2+)), not Cmd_Argv(1) which is our password
|
|
+ Log_Printf( "Rcon: command from \"%s\"\n", adr );
|
|
|
|
if( Rcon_Validate( ))
|
|
{
|