diff --git a/TShockAPI/Handlers/DisplayDollItemSyncHandler.cs b/TShockAPI/Handlers/DisplayDollItemSyncHandler.cs new file mode 100644 index 00000000..71cdc2eb --- /dev/null +++ b/TShockAPI/Handlers/DisplayDollItemSyncHandler.cs @@ -0,0 +1,27 @@ +using System; +using System.Collections.Generic; +using System.Linq; +using System.Text; +using System.Threading.Tasks; +using static TShockAPI.GetDataHandlers; + +namespace TShockAPI.Handlers +{ + /// + /// Handles the TileEntityDisplayDollItemSync packets and checks for permissions. + /// + public class DisplayDollItemSyncHandler : IPacketHandler + { + public void OnReceive(object sender, DisplayDollItemSyncEventArgs args) + { + /// If the player has no building permissions means that they couldn't even see the content of the doll in the first place. + /// Thus, they would not be able to modify its content. This means that a hacker attempted to send this packet directly, or through raw bytes to tamper with the DisplayDoll. This is why I do not bother with making sure the player gets their item back. + if (!args.Player.HasBuildPermission(args.DisplayDollEntity.Position.X, args.DisplayDollEntity.Position.Y, false)) + { + args.Player.SendErrorMessage("You do not have permission to modify a Mannequin in a protected area!"); + args.Handled = true; + return; + } + } + } +} diff --git a/TShockAPI/TShockAPI.csproj b/TShockAPI/TShockAPI.csproj index f9885393..3afe3d0d 100644 --- a/TShockAPI/TShockAPI.csproj +++ b/TShockAPI/TShockAPI.csproj @@ -88,6 +88,7 @@ +