themaster1970sf/TShock
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

Update changelog to be _much_ more verbose about GHSA-jq4j-v8pr-jv7j

Browse source
This commit is contained in:
James Puleo 2021-07-21 21:40:44 -04:00
parent 6ad57ba517
commit 853715cfa7
No known key found for this signature in database
GPG key ID: 3E16C7EFA34FB15D
1 changed files with 6 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
CHANGELOG.md
View file

@ -29,7 +29,12 @@ This is the rolling changelog for TShock for Terraria. Use past tense when addin
* Correct rejection message in LandGolfBallInCupHandler to output the proper expected player id. (@drunderscore)
* Clarified the error mesage that the console is presented if a rate-limit is reached over REST to indicate that "tokens" actually refers to rate-limit tokens, and not auth tokens, and added a hint as to what config setting determines this. (@hakusaro, @patsore)
* Fixed an issue where, when the console was redirected, input was disabled and commands didn't work, in TSAPI. You can now pass `-disable-commands` to disable the input thread, but by default, it will be enabled. Fixes [#1450](https://github.com/Pryaxis/TShock/issues/1450). (@DeathCradle, @QuiCM)
* Properly sanitized packet tile coordinates that could be used to DoS attack a server. This was assigned [GHSA-jq4j-v8pr-jv7j](https://github.com/Pryaxis/TShock/security/advisories/GHSA-jq4j-v8pr-jv7j). (@drunderscore)
* Fixed Bouncer inconsistently using `TilePlacementValid` when validating tile coordinates, which could cause a DoS attack due to unexpectedly large world framing. The list below shows the corrected methods within Bouncer. This was assigned [GHSA-jq4j-v8pr-jv7j](https://github.com/Pryaxis/Plugins/security/advisories/GHSA-jq4j-v8pr-jv7j). (@drunderscore)
* `OnTileEdit`: The check was moved to be the first, and will no longer `SendTileSquare` upon failure.
* `OnPlaceObject`: The check was moved to be the first, and will no longer `SendTileSquare` upon failure.
* `OnPlaceTileEntity`: The check was newly added.
* `OnPlaceItemFrame`: The check was newly added.
* `OnFoodPlatterTryPlacing`: The check was newly added.
## TShock 4.5.4
* Fixed ridiculous typo in `GetDataHandlers` which caused TShock to read the wrong field in the packet for `usingBiomeTorches`. (@hakusaro, @Arthri)