From de3679f0391f1452532c820f07a8c4042b1c4281 Mon Sep 17 00:00:00 2001
From: s1lentq <s1lentsk@yandex.ru>
Date: Wed, 20 Sep 2023 20:20:14 +0700
Subject: [PATCH] Host_Motd_f: Fixed viewing motd when motdfile is not
 specified

---
 rehlds/engine/common.cpp   | 28 ++++++++++++++++++++++++++++
 rehlds/engine/common.h     |  2 ++
 rehlds/engine/host_cmd.cpp | 10 +++++++++-
 3 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/rehlds/engine/common.cpp b/rehlds/engine/common.cpp
index badf9931b..e70d03ca1 100644
--- a/rehlds/engine/common.cpp
+++ b/rehlds/engine/common.cpp
@@ -1978,6 +1978,34 @@ NOXREF int COM_ExpandFilename(char *filename)
 	return *filename != 0;
 }
 
+// small helper function shared by lots of modules
+qboolean COM_IsAbsolutePath(const char *pStr)
+{
+	if (strchr(pStr, ':') || pStr[0] == '/' || pStr[0] == '\\')
+		return FALSE;
+
+	return TRUE;
+}
+
+qboolean COM_IsValidPath(const char *pszFilename)
+{
+	if (!pszFilename)
+		return FALSE;
+
+	if (Q_strlen(pszFilename) <= 0    ||
+		Q_strstr(pszFilename, "\\\\") ||	// to protect network paths
+		Q_strstr(pszFilename, ":")    ||	// to protect absolute paths
+		Q_strstr(pszFilename, "..")   ||	// to protect relative paths
+		Q_strstr(pszFilename, "~")    ||
+		Q_strstr(pszFilename, "\n")   ||	// CFileSystem_Stdio::FS_fopen doesn't allow this
+		Q_strstr(pszFilename, "\r"))		// CFileSystem_Stdio::FS_fopen doesn't allow this
+	{
+		return FALSE;
+	}
+
+	return TRUE;
+}
+
 int EXT_FUNC COM_FileSize(const char *filename)
 {
 	FileHandle_t fp;
diff --git a/rehlds/engine/common.h b/rehlds/engine/common.h
index 1a7fc081a..94d940480 100644
--- a/rehlds/engine/common.h
+++ b/rehlds/engine/common.h
@@ -187,6 +187,8 @@ void COM_CreatePath(char *path);
 NOXREF void COM_CopyFile(char *netpath, char *cachepath);
 NOXREF int COM_ExpandFilename(char *filename);
 int COM_FileSize(const char *filename);
+qboolean COM_IsAbsolutePath(const char *pStr);
+qboolean COM_IsValidPath(const char *pszFilename);
 unsigned char *COM_LoadFile(const char *path, int usehunk, int *pLength);
 void COM_FreeFile(void *buffer);
 void COM_CopyFileChunk(FileHandle_t dst, FileHandle_t src, int nSize);
diff --git a/rehlds/engine/host_cmd.cpp b/rehlds/engine/host_cmd.cpp
index d76815cb8..3d6558c2b 100644
--- a/rehlds/engine/host_cmd.cpp
+++ b/rehlds/engine/host_cmd.cpp
@@ -205,11 +205,19 @@ void Host_Motd_f(void)
 	char *next;
 
 	pFileList = motdfile.string;
-	if (*pFileList == '/' || Q_strstr(pFileList, ":") || Q_strstr(pFileList, "..") || Q_strstr(pFileList, "\\"))
+	if (!COM_IsValidPath(pFileList) || COM_IsAbsolutePath(pFileList))
 	{
 		Con_Printf("Unable to open %s (contains illegal characters)\n", pFileList);
 		return;
 	}
+
+	const char *pchExtension = COM_FileExtension(pFileList);
+	if (Q_stricmp(pchExtension, "txt") != 0)
+	{
+		Con_Printf("Invalid motdfile name %s (wrong file extension, must be .txt)\n", pFileList);
+		return;
+	}
+
 	pFile = FS_Open(pFileList, "rb");
 	if (!pFile)
 	{