Fixed permission problem in zwho and zmwho and wrote helpfiles.

(cherry picked from commit 8e68ec18aa24689526a4fbda48fca5fbd5dd9123)

diff --git a/game/txt/changes/0.72p4 b/game/txt/changes/0.72p4
index 7d4d7acdba1a425768f248b5994247bf432efa05..42387c16cb82e32271a87c2f265e167453927215 100644 (file)
--- a/game/txt/changes/0.72p4
+++ b/game/txt/changes/0.72p4
@@ -8,6 +8,8 @@ CobraMUSH Version 0.72p4
   Version 0.72p4 is a bugfix/maintenance release of version 0.72.
   It is the fourth bugfix/maintenance release in that series.
 
+  Helpfiles:
+    * Missing zwho/zmwho() helpfiles written. [RLB]
   Fixes:
     * Flags stored in the main database were not being loaded correctly. [RLB]
     * Parts of the RPMODE_SYS were not appropriately enclosed in ifdef
@@ -18,4 +20,5 @@ CobraMUSH Version 0.72p4
     * Fixed a bug related to uninitialized lastmod entries [AEJ]
     * Fixed SHS 64-bit incompatability, to allow password encryption
       to work properly on 64-bit platforms [AEJ]
-
+    * zwho() and zmwho() were insecure and did not properely do permissions checks
+      on if the victim could actually see the people online or not. [RLB]

diff --git a/game/txt/hlp/cobra_func.hlp b/game/txt/hlp/cobra_func.hlp
index dbc52f2fc9b914d5caaa768c754b1dfa6686ced4..6aafe9c7f070f9d72a959f59cf78476f3798db68 100644 (file)
--- a/game/txt/hlp/cobra_func.hlp
+++ b/game/txt/hlp/cobra_func.hlp
@@ -4631,3 +4631,16 @@ See also: lwho(), mwho(), nwho()
   function tries to change the zone on the object before reporting it.
 
   See also: ZONES
+& ZWHO()
+& ZMWHO()
+  zwho(<zone> [, <viewer> ] )
+  zmwho(<zone>)
+
+  These functions return the dbrefs of the players online in a particular
+  zone. Supplying viewer to zwho will show the players the supplied viewer
+  can actually see on by normally typing WHO.
+
+  ZMwho() will show the minimal amount of players online that the lowliest
+  of mortals would actually be able to see.
+
+  See also: lwho()

diff --git a/src/bsd.c b/src/bsd.c
index cf2efce3dc6838d1d3a7e9ed51ac821017e10250..c904e1a32d6d5abe6c995d9d0d6efe7c5c97a255 100644 (file)
--- a/src/bsd.c
+++ b/src/bsd.c
@@ -4122,7 +4122,7 @@ FUNCTION(fun_zwho)
   DESC *d;
   dbref zone, victim;
   int first;
-  int powered = (strcmp(called_as, "ZMWHO") && Priv_Who(executor) || (Inherit_Powers(executor) && Priv_Who(Owner(executor))));
+  int powered = (strcmp(called_as, "ZMWHO") && Priv_Who(executor));
   first = 1;
 
   zone = match_thing(executor, args[0]);
@@ -4139,7 +4139,7 @@ FUNCTION(fun_zwho)
     return;
   }
 
-  if (!GoodObject(zone) || !(eval_lock(victim, zone, Zone_Lock) || CanModify(victim,zone))) {
+  if (!GoodObject(zone) || !(eval_lock(victim, zone, Zone_Lock) || CanSee(victim,zone))) {
     safe_str(T(e_perm), buff, bp);
     return;
   }
@@ -4154,8 +4154,8 @@ FUNCTION(fun_zwho)
     powered = 0;
 
   DESC_ITER_CONN(d) {
-    if (!Hidden(d) || powered) {
-      if (Zone(Location(d->player)) == zone) {
+    if (Zone(Location(d->player)) == zone &&
+       (!Hidden(d) || (powered && CanSee(victim, d->player))) ) {
        if (first) {
          first = 0;
        } else {
@@ -4163,7 +4163,6 @@ FUNCTION(fun_zwho)
        }
        safe_dbref(d->player, buff, bp);
       }
-    }
   }
 }