Merge branch 'jak1/priv_esc_bugfix' into 'master'

fixed minor accesslevel vuln. reported by Hello=).

See merge request legacy/manamarket!15

1 files changed, 3 insertions, 0 deletions

diff --git a/main.py b/main.py
index 2f43894..cd4397e 100755
--- a/main.py
+++ b/main.py
@@ -422,6 +422,9 @@ def process_whisper(nick, msg, mapserv):
             return
 
         if broken_string[1].isdigit() and broken_string[2].isdigit():
+            if int(broken_string[1]) > user.get("accesslevel"):
+                mapserv.sendall(whisper(nick, "You can't give someone a higher accesslevel than your own."))
+                return
             al = int(broken_string[1])
             stalls = int(broken_string[2])
             player_name = " ".join(broken_string[3:])