-Fixed an exploit where players could sneak items through SSI when DisableLoginBeforeJoin was true.

-/overidessi will now actually work on players not logged in...
This commit is contained in:
CoderCow 2013-07-01 12:00:12 +02:00
parent d72c6e4d3c
commit 25e584efe3
3 changed files with 59 additions and 16 deletions

View file

@ -1189,6 +1189,14 @@ namespace TShockAPI
byte prefix = args.Data.ReadInt8();
short type = args.Data.ReadInt16();
// Players send a slot update packet for each inventory slot right after they've joined.
bool bypassTrashCanCheck = false;
if (plr == args.Player.Index && !args.Player.HasSentInventory && slot == NetItem.maxNetInventory)
{
args.Player.HasSentInventory = true;
bypassTrashCanCheck = true;
}
if (OnPlayerSlot(plr, slot, stack, prefix, type))
return true;
@ -1202,6 +1210,7 @@ namespace TShockAPI
return true;
}
// Garabage? Or will it cause some internal initialization or whatever?
var item = new Item();
item.netDefaults(type);
item.Prefix(prefix);
@ -1209,6 +1218,13 @@ namespace TShockAPI
if (args.Player.IsLoggedIn)
{
args.Player.PlayerData.StoreSlot(slot, type, prefix, stack);
}
else if (
TShock.Config.ServerSideInventory && TShock.Config.DisableLoginBeforeJoin && !bypassTrashCanCheck &&
args.Player.HasSentInventory && !args.Player.Group.HasPermission(Permissions.bypassinventorychecks)
) {
// The player might have moved an item to their trash can before they performed a single login attempt yet.
args.Player.IgnoreActionsForClearingTrashCan = true;
}
return false;