issue #48 fixed

releasenotes.md

@@ -2,7 +2,20 @@
 
 
 
-## V2.03.10 (2020-06-96)
+## V2.03.11 (2020-07-21)
+
+### Additions
+
+### Removals
+
+### Changes
+
+### Fixes
+- SaferLua Controller comments bugfix (issue #48)
+- SmartLine Controller bugfix
+
+
+## V2.03.10 (2020-06-06)
 
 ### Additions
 

safer_lua/scanner.lua

@@ -56,7 +56,7 @@ function safer_lua:scanner(text)
 		self.line = line
 		self.pos = 1
 		self.line = trim(self.line)
-		self.line = self.line:split("--")[1]
+		self.line = string.split(self.line, "--", true, 1)[1]
 		table.insert(lToken, idx)  -- line number
 		if self.line then
 			-- devide line in tokens

smartline/icta/commands.lua

@@ -37,6 +37,7 @@ end
 -- '#' is used as placeholder for rule numbers and has to be escaped
 function smartline.escape(s)
 	s = tostring(s)
+	s  = s:gsub('"', '\\"') -- to prevent code injection!!!
 	return s:gsub("#", '"..string.char(35).."')
 end
 
@@ -431,7 +432,7 @@ smartline.icta_register_action("chat", {
 		},
 	},
 	code = function(data, environ) 
-		return 'minetest.chat_send_player("'..environ.owner..'", "[SmartLine Controller] '..data.text..'")'
+		return 'minetest.chat_send_player("'..environ.owner..'", "[SmartLine Controller] '..smartline.escape(data.text)..'")'
 	end,
 	button = function(data, environ) 
 		return 'chat("'..data.text:sub(1,12)..'")'
@@ -518,7 +519,7 @@ smartline.icta_register_condition("playerdetector", {
 	},
 	
 	code = function(data, environ) 
-		return 'smartline.icta_player_detect("'..data.number..'", "'..data.name..'")', "~= nil"
+		return 'smartline.icta_player_detect("'..data.number..'", "'..smartline.escape(data.name)..'")', "~= nil"
 	end,
 	button = function(data, environ) 
 		return "detector("..sl.fmt_number(data.number)..","..data.name:sub(1,8)..")"