diff --git a/lib/Lacuna/DB/Result/Map/Body/Planet.pm b/lib/Lacuna/DB/Result/Map/Body/Planet.pm index f4c45962..0650019c 100644 --- a/lib/Lacuna/DB/Result/Map/Body/Planet.pm +++ b/lib/Lacuna/DB/Result/Map/Body/Planet.pm @@ -700,7 +700,9 @@ has embassy => ( ); sub is_space_free { - my ($self, $x, $y) = @_; + my ($self, $unclean_x, $unclean_y) = @_; + my $x = int( $unclean_x ); + my $y = int( $unclean_y ); my $count = grep {$_->x == $x and $_->y == $y} @{$self->building_cache}; return 0 if $count > 0; return 1; @@ -732,7 +734,9 @@ sub find_free_space { } sub check_for_available_build_space { - my ($self, $x, $y) = @_; + my ($self, $unclean_x, $unclean_y) = @_; + my $x = int( $unclean_x ); + my $y = int( $unclean_y ); if ($x > 5 || $x < -5 || $y > 5 || $y < -5) { confess [1009, "That's not a valid space for a building.", [$x, $y]]; } diff --git a/lib/Lacuna/RPC/Body.pm b/lib/Lacuna/RPC/Body.pm index e7cb9dd1..ab6f5037 100644 --- a/lib/Lacuna/RPC/Body.pm +++ b/lib/Lacuna/RPC/Body.pm @@ -123,8 +123,8 @@ sub rearrange_buildings { my @miss_in_new; my @miss_in_cur; for my $building (@$arrangement) { my $id = $building->{id}; - my $x = $building->{x}; - my $y = $building->{y}; + my $x = int( $building->{x} ); + my $y = int( $building->{y} ); $new_ids{$id} = { x => $x, y => $y, diff --git a/lib/Lacuna/RPC/Building.pm b/lib/Lacuna/RPC/Building.pm index 4a501b7f..71f655e1 100644 --- a/lib/Lacuna/RPC/Building.pm +++ b/lib/Lacuna/RPC/Building.pm @@ -137,10 +137,13 @@ sub view { } sub build { - my ($self, $session_id, $body_id, $x, $y) = @_; + my ($self, $session_id, $body_id, $unclean_x, $unclean_y) = @_; my $empire = $self->get_empire_by_session($session_id); my $body = $self->get_body($empire, $body_id); + my $x = int( $unclean_x ); + my $y = int( $unclean_y ); + if ($x eq '' || $y eq '' || $x < -5 || $y < -5 || $x > 5 || $y > 5) { confess [1009, "You must specify an x,y coordinate to place the building that is between -5 and 5.", [$x, $y]]; } diff --git a/t/090_Build.t b/t/090_Build.t index 9c990c3b..d01824e7 100644 --- a/t/090_Build.t +++ b/t/090_Build.t @@ -202,6 +202,12 @@ $water1->finish_upgrade; $water2->finish_upgrade; $water3->finish_upgrade; +# Make sure non-integer coordinates don't work +$result = $tester->post('waterpurification', 'build', [$session_id, $home_planet, '3.1', -3]); +ok(exists $result->{error}, 'non-integer string attack thwarted!'); +$result = $tester->post('waterpurification', 'build', [$session_id, $home_planet, 3.2, -3]); +ok(exists $result->{error}, 'non-integer number attack thwarted!'); + $home->add_plan('Lacuna::DB::Result::Building::SpacePort',1,4); $home->add_plan('Lacuna::DB::Result::Building::SpacePort',1); $home->add_plan('Lacuna::DB::Result::Building::SpacePort',1,3);