Forbid object:attach(obj, ...) (#9762)

[dragonfireclient.git] / src / script / cpp_api / s_security.cpp

diff --git a/src/script/cpp_api/s_security.cpp b/src/script/cpp_api/s_security.cpp
index fd68a2cb0b0b18217417d7554de95de467b809ab..2afa3a191d1ce7b8b451c89cebba44570dc24caa 100644 (file)
--- a/src/script/cpp_api/s_security.cpp
+++ b/src/script/cpp_api/s_security.cpp
@@ -499,7 +499,12 @@ bool ScriptApiSecurity::checkPath(lua_State *L, const char *path,
 
        // Get server from registry
        lua_rawgeti(L, LUA_REGISTRYINDEX, CUSTOM_RIDX_SCRIPTAPI);
-       ScriptApiBase *script = (ScriptApiBase *) lua_touserdata(L, -1);
+       ScriptApiBase *script;
+#if INDIRECT_SCRIPTAPI_RIDX
+       script = (ScriptApiBase *) *(void**)(lua_touserdata(L, -1));
+#else
+       script = (ScriptApiBase *) lua_touserdata(L, -1);
+#endif
        lua_pop(L, 1);
        const IGameDef *gamedef = script->getGameDef();
        if (!gamedef)
@@ -627,16 +632,19 @@ int ScriptApiSecurity::sl_g_loadfile(lua_State *L)
        ScriptApiBase *script = (ScriptApiBase *) lua_touserdata(L, -1);
        lua_pop(L, 1);
 
+       // Client implementation
        if (script->getType() == ScriptingType::Client) {
-               std::string display_path = readParam<std::string>(L, 1);
-               const std::string *path = script->getClient()->getModFile(display_path);
-               if (!path) {
-                       std::string error_msg = "Coudln't find script called:" + display_path;
+               std::string path = readParam<std::string>(L, 1);
+               const std::string *contents = script->getClient()->getModFile(path);
+               if (!contents) {
+                       std::string error_msg = "Coudln't find script called: " + path;
                        lua_pushnil(L);
                        lua_pushstring(L, error_msg.c_str());
                        return 2;
                }
-               if (!safeLoadFile(L, path->c_str(), display_path.c_str())) {
+
+               std::string chunk_name = "@" + path;
+               if (!safeLoadString(L, *contents, chunk_name.c_str())) {
                        lua_pushnil(L);
                        lua_insert(L, -2);
                        return 2;
@@ -644,6 +652,8 @@ int ScriptApiSecurity::sl_g_loadfile(lua_State *L)
                return 1;
        }
 #endif
+
+       // Server implementation
        const char *path = NULL;
        if (lua_isstring(L, 1)) {
                path = lua_tostring(L, 1);