v0.18, ICTA controller: quotation mark escape added

README.md

@@ -75,6 +75,14 @@ Available worlds will be converted to 'lsqlite3', but there is no way back, so:
 
 ### History
 
+**2020-07-21  V0.18**
+- Pull request #13: Use Monospace Font for Code-Related Formspecs (from Thomas-S)
+- Pull request #14: Don't allow to put items with meta or wear information into the 8x2000 chest (from Thomas-S)
+- Pull request #15: Blackhole: Add support for liquids (from Thomas-S)
+- Pull request #16: ICTA Controller: Add support for valves by adding on/off states (from Thomas-S)
+- Bugfix: Digging Redstone gives an 'unknown block'
+- ICTA Controller: Escape quotation marks for text outputs
+
 **2020-07-16  V0.17**
 - TA4 Reactor recipe bugfix
 - TA3 furnace power bugfix (response to the pull request #12 from Thomas-S)

icta_controller/commands.lua

@@ -53,6 +53,7 @@ end
 -- '#' is used as placeholder for rule numbers and has to be escaped
 function techage.icta_escape(s)
 	s = tostring(s)
+	s  = s:gsub('"', '\\"') -- to prevent code injection!!!
 	return s:gsub("#", '"..string.char(35).."')
 end
 
@@ -553,7 +554,7 @@ techage.icta_register_action("chat", {
 		},
 	},
 	code = function(data, environ) 
-		return 'minetest.chat_send_player("'..environ.owner..'", "[TA4 ICTA Controller] '..data.text..'    ")'
+		return 'minetest.chat_send_player("'..environ.owner..'", "[TA4 ICTA Controller] '..techage.icta_escape(data.text)..'    ")'
 	end,
 	button = function(data, environ) 
 		return 'chat("'..data.text:sub(1,12)..'")'
@@ -644,7 +645,7 @@ techage.icta_register_condition("playerdetector", {
 	},
 	
 	code = function(data, environ) 
-		return 'techage.icta_player_detect("'..environ.number..'", "'..data.number..'", "'..data.name..'")', "~= nil"
+		return 'techage.icta_player_detect("'..environ.number..'", "'..data.number..'", "'..techage.icta_escape(data.name)..'")', "~= nil"
 	end,
 	button = function(data, environ) 
 		return "detector("..techage.fmt_number(data.number)..","..data.name:sub(1,8)..")"

init.lua

@@ -13,7 +13,7 @@
 techage = {}
 
 -- Version for compatibility checks, see readme.md/history
-techage.version = 0.17
+techage.version = 0.18
 
 if minetest.global_exists("tubelib") then
 	minetest.log("error", "[techage] Techage can't be used together with the mod tubelib!")