Fixed permission problem in zwho and zmwho and wrote helpfiles.

(cherry picked from commit 8e68ec18aa24689526a4fbda48fca5fbd5dd9123)

diff --git a/game/txt/changes/0.72p4 b/game/txt/changes/0.72p4
index 7d4d7acdba1a425768f248b5994247bf432efa05..42387c16cb82e32271a87c2f265e167453927215 100644 (file)
--- a/game/txt/changes/0.72p4
+++ b/game/txt/changes/0.72p4
@@ -8,6 +8,8 @@ CobraMUSH Version 0.72p4
   Version 0.72p4 is a bugfix/maintenance release of version 0.72.
   It is the fourth bugfix/maintenance release in that series.
 
+  Helpfiles:
+    * Missing zwho/zmwho() helpfiles written. [RLB]
   Fixes:
     * Flags stored in the main database were not being loaded correctly. [RLB]
     * Parts of the RPMODE_SYS were not appropriately enclosed in ifdef
@@ -18,4 +20,5 @@ CobraMUSH Version 0.72p4
     * Fixed a bug related to uninitialized lastmod entries [AEJ]
     * Fixed SHS 64-bit incompatability, to allow password encryption
       to work properly on 64-bit platforms [AEJ]
-
+    * zwho() and zmwho() were insecure and did not properely do permissions checks
+      on if the victim could actually see the people online or not. [RLB]

diff --git a/game/txt/hlp/cobra_func.hlp b/game/txt/hlp/cobra_func.hlp
index 27aab98904eabe97e8b779ffeb6b2876118f5e8d..25c872515e8981ae88348b4cac846ab2b5ce0ee9 100644 (file)
--- a/game/txt/hlp/cobra_func.hlp
+++ b/game/txt/hlp/cobra_func.hlp
@@ -4188,3 +4188,16 @@ for an object named "Test", preferring a thing over other types.
   function tries to change the zone on the object before reporting it.
 
   See also: ZONES
+& ZWHO()
+& ZMWHO()
+  zwho(<zone> [, <viewer> ] )
+  zmwho(<zone>)
+
+  These functions return the dbrefs of the players online in a particular
+  zone. Supplying viewer to zwho will show the players the supplied viewer
+  can actually see on by normally typing WHO.
+
+  ZMwho() will show the minimal amount of players online that the lowliest
+  of mortals would actually be able to see.
+
+  See also: lwho()

diff --git a/src/bsd.c b/src/bsd.c
index 2f6a8bbc67c6661e27ee7f05042f60934314cc8e..a1e15f85f29571a61688f8c6c11dcbe40b566c57 100644 (file)
--- a/src/bsd.c
+++ b/src/bsd.c
@@ -4224,7 +4224,7 @@ FUNCTION(fun_zwho)
   DESC *d;
   dbref zone, victim;
   int first;
-  int powered = (strcmp(called_as, "ZMWHO") && Priv_Who(executor) || (Inherit_Powers(executor) && Priv_Who(Owner(executor))));
+  int powered = (strcmp(called_as, "ZMWHO") && Priv_Who(executor));
   first = 1;
 
   zone = match_thing(executor, args[0]);
@@ -4241,7 +4241,7 @@ FUNCTION(fun_zwho)
     return;
   }
 
-  if (!GoodObject(zone) || !(eval_lock(victim, zone, Zone_Lock) || CanModify(victim,zone))) {
+  if (!GoodObject(zone) || !(eval_lock(victim, zone, Zone_Lock) || CanSee(victim,zone))) {
     safe_str(T(e_perm), buff, bp);
     return;
   }
@@ -4256,8 +4256,8 @@ FUNCTION(fun_zwho)
     powered = 0;
 
   DESC_ITER_CONN(d) {
-    if (!Hidden(d) || powered) {
-      if (Zone(Location(d->player)) == zone) {
+    if (Zone(Location(d->player)) == zone &&
+       (!Hidden(d) || (powered && CanSee(victim, d->player))) ) {
        if (first) {
          first = 0;
        } else {
@@ -4265,7 +4265,6 @@ FUNCTION(fun_zwho)
        }
        safe_dbref(d->player, buff, bp);
       }
-    }
   }
 }