hakowork/rojo
3
0
Fork 0
mirror of https://github.com/rojo-rbx/rojo.git synced 2026-10-21 20:21:38 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Sanitiza requested APIs

Browse source
This commit is contained in:
boatbomber 2022-10-08 10:25:42 -04:00
parent 7c0a67ba86
commit ebdffb0088
1 changed files with 15 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

20
plugin/src/HeadlessAPI.lua
View file

@ -148,8 +148,7 @@ function API.new(app)
end
function Rojo:RequestAccess(apis: {string}): {[string]: boolean}
assert(type(apis) == "table", "Rojo:RequestAccess expects an array of API names")
assert(#apis > 0, "Rojo:RequestAccess expects an array of API names")
assert(type(apis) == "table", "Rojo:RequestAccess expects an array of valid API names")
if Rojo:_checkRateLimit("RequestAccess") then
-- Because this opens a popup, we dont want to let users get spammed by it
@ -162,8 +161,19 @@ function API.new(app)
Rojo._permissions[source] = {}
end
local alreadyAllowed = true
-- Sanitize request
local sanitizedApis = {}
for _, api in apis do
if Rojo[api] then
table.insert(sanitizedApis, api)
else
warn(string.format("Rojo.%s is not a valid API", api))
end
end
assert(#sanitizedApis > 0, "Rojo:RequestAccess expects an array of valid API names")
local alreadyAllowed = true
for _, api in sanitizedApis do
if not Rojo._permissions[source][api] then
alreadyAllowed = false
break
@ -172,13 +182,13 @@ function API.new(app)
if alreadyAllowed then
local response = {}
for _, api in apis do
for _, api in sanitizedApis do
response[api] = true
end
return response
end
local response = app:requestPermission(source, name, apis, Rojo._permissions[source])
local response = app:requestPermission(source, name, sanitizedApis, Rojo._permissions[source])
for api, granted in response do
Log.warn(string.format(