Bug - Fixed Bypassing visit_url chat/mall restrictions

[Catch-22]

Well, although I'm pretty pleased with my solution, I have to unfortunately disclose this as a bug.

http://kolmafia.us/showthread.php?1...from-player-name&p=73123&viewfull=1#post73123

My implementation in itself is pretty harmless, but the same trick can be used for more nefarious purposes, such as to spam chat channels, or do unrestricted mall searches.

It's simple enough to build from SVN with the restrictions removed anyway, but that's not really the point...

 

[Catch-22]

Seems to be fixed in r10921.

Seems to be fixed in r10921.

Not for the mall...

Not for the mall...

and the chat fix is also trivial to bypass, so I'm guessing there's a reason Hola left this open.

 

[Catch-22]

If any dev would like me to PM them some ASH samples that exploit this behavior, let me know.

 

[lostcalpolydude]

I think I got all of this with 11038.

 

[Catch-22]

I think I got all of this with 11038.

I'll let you know if I find anything

Edit: Okay, there's one more for chat, I'll just shoot through a patch!