From 6bd6415749eac9c6b0d8dd051736a9dc07d022d2 Mon Sep 17 00:00:00 2001
From: Gnome Ann <>
Date: Wed, 1 Sep 2021 13:55:25 -0400
Subject: [PATCH] Prevent remote-mode-forbidden actions server-side

Since some user interface buttons are disabled while in --remote mode,
they should also be disabled in aiserver.py so a malicious user can't
manually send those commands to the server.
---
 aiserver.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/aiserver.py b/aiserver.py
index c8703443..a32abb9a 100644
--- a/aiserver.py
+++ b/aiserver.py
@@ -610,11 +610,11 @@ def get_message(msg):
         deleterequest()
     elif(msg['cmd'] == 'memory'):
         togglememorymode()
-    elif(msg['cmd'] == 'savetofile'):
+    elif(not vars.remote and msg['cmd'] == 'savetofile'):
         savetofile()
-    elif(msg['cmd'] == 'loadfromfile'):
+    elif(not vars.remote and msg['cmd'] == 'loadfromfile'):
         loadfromfile()
-    elif(msg['cmd'] == 'import'):
+    elif(not vars.remote and msg['cmd'] == 'import'):
         importRequest()
     elif(msg['cmd'] == 'newgame'):
         newGameRequest()
@@ -755,7 +755,7 @@ def get_message(msg):
         vars.adventure = msg['data']
         settingschanged()
         refresh_settings()
-    elif(msg['cmd'] == 'importwi'):
+    elif(not vars.remote and msg['cmd'] == 'importwi'):
         wiimportrequest()
     
 #==================================================================#