Re: Means of gathering data

• Date: Fri, 14 Jun 1996 12:28:11 PDT
• From:
  Michael Moore <mike@mail.datasys.net>
• cc: MOO-Cows.PARC@xerox.com
• Content-Transfer-Encoding: 7bit
• Content-Type: text/plain; charset=us-ascii
• Organization: Tom C. Davis & Associates, P.C.
• References: <Pine.SUN.3.92.960610135034.10192A-100000@merv.cs.nyu.edu> <v03006f03ade765417f56@[132.76.55.130]>

Gustavo Glusman wrote:
> 
> Michael Moore wrote:
> >Here is a dump of the Generic Tape Recorder I wrote for logging interviews
> >on my MOO:
> 
> (snip)
> 
> >@chmod #1875:start rx
> >@program #1875:start
> >if (player.wizard)
> >  if (this.on)
> >    player:tell_with_subs("%T %<is> already recording.");
> >  else
> >    this.on = 1;
> >    $you:say_action(this.start_msg);
> >  endif
> >else
> >  return E_PERM;
> >endif
> >.
> 
> Please note that this verb, and many others in this dump, are insecure.
> They are +x and check whether the 'player' is a wizard - not a good
> combination!

Please explain to me the nature of the insecurity.  To me, it seems fine--
'player' is the object number of the player who initiated the task
that resulted in this code being run.  If that player's .wizard = 0 then
they will get E_PERM.

Is there some wiz-owned core code I don't know about that changes 'player'
to a wizard then executes other verbs with impunity?  I would point to _that_
code as being a security leak.

I wanted the code to be +x so wizards could write code of their own that
could call these verbs, and I checked .wizard because I wanted these things
to be wiz-only, period.

If I'm stupidly missing something blatantly obvious, please tell me.

Or did you just mean the code is lacking in self-confidence?  ;)

• Re: Means of gathering data
• From: Gustavo Glusman <bmgustav@bioinformatics.weizmann.ac.il>
• Re: Means of gathering data
• From: tom@mvision.com (Tom Ritchford)

• Means of gathering data
• From: Irina Sadomova <irina@merv.cs.nyu.edu>
• Re: Means of gathering data
• From: Gustavo Glusman <bmgustav@bioinformatics.weizmann.ac.il>

• Prev: Re: Means of gathering data
• Next: Re: Means of gathering data
• Index: MOO-cows
• Thread: MOO-cows