Zugg Software :: View topic

Newbie Joined: 21 Sep 2002 Posts: 8

hi forum,
i have a hard time doing the following:
i have a nice little trigger to put roomnames to a text file for reference, done with a trigger like (*) ~[ (*)~] - the parantheses are sent after every roomname one my mud, the first * should capture the roomname itself.
This works just fine except for cases where the name includes chars like & (the string gets cut after the &, the first part is dumped), commas aren't captured too...
I hope the problem is clear, of course the question is: what pattern would match just every char from 0 to 255 if * doesn't? :)
thanks,
joe

Newbie Joined: 21 Sep 2002 Posts: 8

ok - %* seems to do the job. Just saw it in another post on the board. Zugg might want to add a hint to this to the patternmatching section of the helpfiles. :]
joe

GURU Joined: 10 Oct 2000 Posts: 4379 Location: USA

%* is not for everyone to use. That is why it is not mentioned so much. Misuse of this wildcard may lead to people exploiting your triggers and doing bad stuff to you. For example, let's take your pattern:
#TRIGGER {(%*) ~[(*)~]} {#VAR roomname %1}

and now comes someone in the MUD and tells you this:
Kjata tells you 'nothing;remove all;drop all;quit [some more fake text]'

Your trigger will fire on this line and %1 will be:
nothing;remove all;drop all;quit

When this is replaced in #VAR, it ends up like this:
#VAR roomname nothing;remove all;drop all;quit

You can guess what will happen when zMUD executes this. For this reason, you must be extra careful when usin %* and think of any possible way that your trigger might be exploited.

Kjata

Newbie Joined: 21 Sep 2002 Posts: 8

thanks - thats a point.
All i need to do now is filter the ; from %1 before assigning it and it should be safe right?
joe

GURU Joined: 10 Oct 2000 Posts: 4379 Location: USA

That's an option. You might also want to stop your trigger from firing on output from other users by using ^ and $ to denote the beginning and ending of the line.

Kjata

Adept Joined: 09 Nov 2000 Posts: 222 Location: USA

Heh.. how about in my mud where users have access to the ECHO command? *grin* Yeah, it puts the persons name at the end of the echo, to minimize abuse, but.....