Prevent players accessing inventories of other players (#10341)

minetest · Aug 29, 2020 · 3693b68 · 3693b68
1 parent d28f1b0
commit 3693b68
Showing 1 changed file with 13 additions and 7 deletions.
diff --git a/src/network/serverpackethandler.cpp b/src/network/serverpackethandler.cpp
@@ -630,13 +630,19 @@ void Server::handleCommand_InventoryAction(NetworkPacket* pkt)
 		if (ma->from_inv != ma->to_inv)
 			m_inventory_mgr->setInventoryModified(ma->to_inv);
 
-		bool from_inv_is_current_player =
-			(ma->from_inv.type == InventoryLocation::PLAYER) &&
-			(ma->from_inv.name == player->getName());
-
-		bool to_inv_is_current_player =
-			(ma->to_inv.type == InventoryLocation::PLAYER) &&
-			(ma->to_inv.name == player->getName());
+		bool from_inv_is_current_player = false;
+		if (ma->from_inv.type == InventoryLocation::PLAYER) {
+			if (ma->from_inv.name != player->getName())
+				return;
+			from_inv_is_current_player = true;
+		}
+
+		bool to_inv_is_current_player = false;
+		if (ma->to_inv.type == InventoryLocation::PLAYER) {
+			if (ma->to_inv.name != player->getName())
+				return;
+			to_inv_is_current_player = true;
+		}
 
 		InventoryLocation *remote = from_inv_is_current_player ?
 			&ma->to_inv : &ma->from_inv;