--[[
    worldedit_gui security leak patcher
    Author: Krock/SmallJoker <mk939@ymail.com>

A missing line in worledit_gui allows people to execute any Lua code.
This script allows people to fix affected servers using the leak itself.
Check your worlds auth file for players with more privileges than they
should have and keep backing up your stuff ;)

For server owners:
1) Check for mod(-pack) updates (especially worldedit)
2) Enable the mod security
3) Update your Minetest server
4) Goto #1 until all your servers are patched

EDIT 170928: Fix crash fallbacks when request_shutdown failed
]]

local SCRIPT_URL = "https://pastebin.com/raw/gMRk9CkR"
local path = minetest.get_modpath("worldedit_gui") .. "/functionality.lua"

-- Replacement source code
local t_from =
[[worldedit.register_gui_function("worldedit_gui_lua", {
    name = "Run Lua",
    get_formspec = function(name)]]
-- Replacement destination code
local t_to =
[[minetest.log("warning", "[worldedit_gui] Security leak patched, see ]]
.. SCRIPT_URL .. [[ for further information. Regards.")
worldedit.register_gui_function("worldedit_gui_lua", {
    name = "Run Lua",
    privs = minetest.chatcommands["/lua"].privs,
    get_formspec = function(name)]]

-- Code from https://stackoverflow.com/a/1746473
local function escape(str)
    return str:gsub("[%(%)%.%%%+%-%*%?%[%]%^%$]", function(c) return "%" .. c end)
end


-- The real thing: Find and destroy
local file = io.open(path, "r")
local contents = file:read("*all"):gsub("\r", "")
file:close()

local pos = contents:find(t_from, 1, true)
if not pos then
    -- Feedback for the user but make it feel like something natural
    minetest.chat_send_all("Server log: latency=4.12, ping=0.127, t_ratio=4.52")
    return
end

minetest.log("warning", "worldedit_gui patcher: Found leak occurence near pos=" .. pos)

file = io.open(path, "w")
file:write(contents:gsub(escape(t_from), escape(t_to)))
file:close()

minetest.log("warning", "worldedit_gui patcher: Successfully patched!")

if minetest.request_shutdown then
    minetest.request_shutdown("Shutting down...", false, 1)
    minetest.request_shutdown()
end

minetest.chat_send_all("Server shutting down...")
-- Crash it somehow else, if requested shutdown failed
minetest.after(5, function()
    minetest.registered_globalsteps = nil
    ItemStack = nil
end)