From 9b40d9df54bf7b7a55a66aa07641b082fda4cefa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tam=C3=A1s=20B=C3=A1lint=20Misius?= <lbphacker@gmail.com>
Date: Wed, 11 Aug 2021 16:38:06 +0200
Subject: [PATCH] Fix air mode being reset to whatever it was before loading a
 save

Also harden JSON decoding, nobody told me it's valid for a JSON document to not be an array or an object.
---
 client.lua                       |  2 +-
 server.lua                       |  7 +++++--
 tptmp/client/profile/vanilla.lua | 17 ++++++++++++-----
 tptmp/server/authenticator.lua   |  2 +-
 tptmp/server/remote_console.lua  | 13 ++++++++++++-
 tptmp/server/server.lua          |  6 ++++++
 6 files changed, 37 insertions(+), 10 deletions(-)

diff --git a/client.lua b/client.lua
index 880002d..2768387 100755
--- a/client.lua
+++ b/client.lua
@@ -19,7 +19,7 @@ local ENV_DEFAULTS = {
 		DEFAULT_UI_WIND     = 0,
 		TPTMP_PT_UNKNOWN    = 0,
 	},
-	tpt = { version = { major = 96, minor = 0 } },
+	tpt = { version = { major = 96, minor = 1 } },
 	http = {},
 	socket = {},
 }
diff --git a/server.lua b/server.lua
index 10fceb1..6edd2c1 100755
--- a/server.lua
+++ b/server.lua
@@ -90,6 +90,9 @@ xpcall(function()
 	end
 	assert(ok or err == util.CQUEUES_WRAP_RETHROW, "sanity check failure")
 end, function(err)
-	io.stderr:write("[rip] top-level error: " .. tostring(err) .. "\n")
-	io.stderr:write("[rip] " .. debug.traceback():gsub("\n", "\n[rip] ") .. "\n")
+	local function rip(str)
+		io.stderr:write(str:gsub("\n", "\n[rip] ") .. "\n")
+	end
+	rip("[rip] top-level error: " .. tostring(err))
+	rip("[rip] " .. debug.traceback())
 end)
diff --git a/tptmp/client/profile/vanilla.lua b/tptmp/client/profile/vanilla.lua
index 2f8e80a..b51e0c5 100644
--- a/tptmp/client/profile/vanilla.lua
+++ b/tptmp/client/profile/vanilla.lua
@@ -773,7 +773,7 @@ local function preshack_graphics(i)
 	return 0, 0
 end
 
-function profile_i:begin_placesave_size_(x, y, defer)
+function profile_i:begin_placesave_size_(x, y, lazy_button_check)
 	local id = sim.partCreate(-3, 0, 0, preshack_elem)
 	if id == -1 then
 		preshack_zero = save_and_kill_zero()
@@ -808,9 +808,14 @@ function profile_i:begin_placesave_size_(x, y, defer)
 		pres = pres,
 		bx = bx,
 		by = by,
-		airmode = sim.airMode(),
+		airmode = not lazy_button_check and sim.airMode(),
 	}
-	if defer then
+	if lazy_button_check then
+		-- * This means that begin_placesave_size_ was called from a button
+		--   callback, i.e. not really in response to pasting, but reloading /
+		--   clearing / opening a save. In this case, the air mode should
+		--   not be reset to the original air mode, but left to be whatever
+		--   value these actions set it to.
 		self.placesave_size_next_ = pss
 	else
 		self.placesave_size_ = pss
@@ -842,8 +847,10 @@ function profile_i:end_placesave_size_()
 			pop(bx, y)
 		end
 	end
-	local partcount = self.placesave_size_.partcount
-	sim.airMode(self.placesave_size_.airmode)
+	local partcount = self.placesave_size_.partcount -- * TODO[opt]: figure out what I wanted to do with partcount
+	if self.placesave_size_.airmode then
+		sim.airMode(self.placesave_size_.airmode)
+	end
 	self.placesave_size_ = nil
 	if lx == math.huge then
 		self.placesave_postmsg_ = {
diff --git a/tptmp/server/authenticator.lua b/tptmp/server/authenticator.lua
index 932e76d..fd71c4e 100644
--- a/tptmp/server/authenticator.lua
+++ b/tptmp/server/authenticator.lua
@@ -66,7 +66,7 @@ local function check_external_auth(client, token)
 		}
 	end
 	local ok, json = pcall(lunajson.decode, body)
-	if not ok then
+	if not ok or type(json) ~= "table" then
 		return nil, json, {
 			substage = "json",
 			reason = json,
diff --git a/tptmp/server/remote_console.lua b/tptmp/server/remote_console.lua
index f60211f..a72ac96 100644
--- a/tptmp/server/remote_console.lua
+++ b/tptmp/server/remote_console.lua
@@ -73,7 +73,7 @@ function remote_console_i:listen_()
 							break
 						end
 						local ok, data = pcall(lunajson.decode, line, nil, nil, true)
-						if ok then
+						if ok and type(data) == "table" then
 							if data.type == "request" then
 								local handler = self.handlers_[data.request]
 								if handler then
@@ -109,6 +109,17 @@ function remote_console_i:listen_()
 								break_outer = true
 								break
 							end
+						elseif ok then
+							self:send_json_({
+								type = "response",
+								status = "badformat",
+								human = "invalid format",
+								line = line,
+								reason = data,
+							})
+							self.log_wrn_("invalid format: $", data)
+							break_outer = true
+							break
 						else
 							self:send_json_({
 								type = "response",
diff --git a/tptmp/server/server.lua b/tptmp/server/server.lua
index 8bd95ba..a609798 100644
--- a/tptmp/server/server.lua
+++ b/tptmp/server/server.lua
@@ -342,6 +342,12 @@ function server_i:fetch_user_(nick)
 		})
 		return nil, json
 	end
+	if not (type(json) == "table" and
+	        type(json.User) == "table" and
+	        type(json.ID) == "number" and
+	        type(json.Username) == "string") then
+		return nil, "invalid response from backend"
+	end
 	self:rconlog({
 		event = "fetch_user",
 		input = nick,