diff --git a/ProjectLighthouse.Servers.GameServer/Controllers/UserController.cs b/ProjectLighthouse.Servers.GameServer/Controllers/UserController.cs index ace3b945..fb5b6128 100644 --- a/ProjectLighthouse.Servers.GameServer/Controllers/UserController.cs +++ b/ProjectLighthouse.Servers.GameServer/Controllers/UserController.cs @@ -1,4 +1,3 @@ -#nullable enable using System.Text.Json; using LBPUnion.ProjectLighthouse.Database; using LBPUnion.ProjectLighthouse.Extensions; @@ -82,7 +81,7 @@ public class UserController : ControllerBase if (update.Location != null) user.Location = update.Location; // ReSharper disable once LoopCanBeConvertedToQuery - foreach (string? resource in new[]{update.IconHash, update.YayHash, update.MehHash, update.BooHash, update.PlanetHash,}) + foreach (string? resource in new[]{update.IconHash, update.YayHash, update.MehHash, update.BooHash,}) { if (string.IsNullOrWhiteSpace(resource)) continue; @@ -91,6 +90,9 @@ public class UserController : ControllerBase if (!GameResourceHelper.IsValidTexture(resource)) return this.BadRequest(); } + if (!string.IsNullOrWhiteSpace(update.PlanetHash) && !GameResourceHelper.IsValidLevel(update.PlanetHash)) + return this.BadRequest(); + if (update.IconHash != null) user.IconHash = update.IconHash; if (update.YayHash != null) user.YayHash = update.YayHash; diff --git a/ProjectLighthouse.Servers.GameServer/Helpers/GameResourceHelper.cs b/ProjectLighthouse.Servers.GameServer/Helpers/GameResourceHelper.cs index 3932724e..597f3833 100644 --- a/ProjectLighthouse.Servers.GameServer/Helpers/GameResourceHelper.cs +++ b/ProjectLighthouse.Servers.GameServer/Helpers/GameResourceHelper.cs @@ -37,4 +37,13 @@ public static class GameResourceHelper return LbpFile.FromHash(resource)?.FileType is LbpFileType.Png or LbpFileType.Jpeg or LbpFileType.Painting or LbpFileType.Texture; } + + public static bool IsValidLevel(string resource) + { + if (!FileHelper.IsResourceValid(resource)) return false; + + // Technically this method could be used (and is used) to check if a planet is valid, + // but I'm keeping the method name as is for semantic reasons. + return LbpFile.FromHash(resource)?.FileType is LbpFileType.Level; + } } \ No newline at end of file