Merge branch 'general-devel' into upstream-general-devel

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,19 +1,3 @@
 <!-- Warning: If you create a pull request and wish to remain anonymous, you are highly advised to use Tails (https://tails.boum.org/) or a fresh git environment. We will *not* be able to help with anonymization after your pull request has been created. -->
 
-?????? HAVE YOU UPDATED THE CHANGELOG? ??????
+<!-- Warning: If you do not update the changelog, your pull request will be ignored and eventually closed, without comment, without any support, and without any opinion or interaction from the TShock team. This is your only warning. -->
-?????? HAVE YOU UPDATED THE CHANGELOG? ??????
-?????? HAVE YOU UPDATED THE CHANGELOG? ??????
-?????? HAVE YOU UPDATED THE CHANGELOG? ??????
-?????? HAVE YOU UPDATED THE CHANGELOG? ??????
-?????? HAVE YOU UPDATED THE CHANGELOG? ??????
-?????? HAVE YOU UPDATED THE CHANGELOG? ??????
-?????? HAVE YOU UPDATED THE CHANGELOG? ??????
-?????? HAVE YOU UPDATED THE CHANGELOG? ??????
-?????? HAVE YOU UPDATED THE CHANGELOG? ??????
-?????? HAVE YOU UPDATED THE CHANGELOG? ??????
-?????? HAVE YOU UPDATED THE CHANGELOG? ??????
-?????? HAVE YOU UPDATED THE CHANGELOG? ??????
-?????? HAVE YOU UPDATED THE CHANGELOG? ??????
-?????? HAVE YOU UPDATED THE CHANGELOG? ??????
-?????? HAVE YOU UPDATED THE CHANGELOG? ??????
-?????? HAVE YOU UPDATED THE CHANGELOG? ??????

CHANGELOG.md

@@ -14,6 +14,7 @@ This is the rolling changelog for TShock for Terraria. Use past tense when addin
 
 ## Upcoming changes
 * Fix some typos that have been in the repository for over a lustrum. (@Killia0)
+* Fixed SendTileRectHandler not sending tile rect updates like Pylons/Mannequins to other clients. (@Stealownz)
 * Changed the world autosave message so that it no longer warns of a "potential lag spike." (@hakusaro)
 * Added `/slay` as an alias for `/kill` to be more consistent with other server mods. (@hakusaro)
 * Added `/god` as an alias for `/godmode` to be more consistent with other server mods. (@hakusaro)
@@ -33,6 +34,12 @@ This is the rolling changelog for TShock for Terraria. Use past tense when addin
 * Added `summonboss` permission check for Prismatic Lacewing. Players who do not have said permission will be unable to kill this critter, as it will summon the Empress of Light. Also added support for the `AnonymousBossInvasions` config option, if this is set to `false` it will now broadcast the name of the player who summoned her. (@moisterrific)
 * Added `ForceTime` config setting check for Enchanted Sundial usage. If `ForceTime` is set to anything other than `normal`, Sundial use will be rejected as this would lead to very janky game behavior. Additionally, players with `cfgreload` permission will be advised  to change it back to `normal` in order to use sundial. (@moisterrific, @bartico6)
 * Added `%onlineplayers%` and `%serverslots%` placeholders for MOTD. The default MOTD message was also updated to use this. (@moisterrific, @bartico6)
+* Fixed Bouncer inconsistently using `TilePlacementValid` when validating tile coordinates, which could cause a DoS attack due to unexpectedly large world framing. The list below shows the corrected methods within Bouncer. This was assigned [GHSA-jq4j-v8pr-jv7j](https://github.com/Pryaxis/TShock/security/advisories/GHSA-jq4j-v8pr-jv7j). (@drunderscore)
+  * `OnTileEdit`: The check was moved to be the first, and will no longer `SendTileSquare` upon failure.
+  * `OnPlaceObject`: The check was moved to be the first, and will no longer `SendTileSquare` upon failure.
+  * `OnPlaceTileEntity`: The check was newly added.
+  * `OnPlaceItemFrame`: The check was newly added.
+  * `OnFoodPlatterTryPlacing`: The check was newly added.
 
 ## TShock 4.5.4
 * Fixed ridiculous typo in `GetDataHandlers` which caused TShock to read the wrong field in the packet for `usingBiomeTorches`. (@hakusaro, @Arthri)

TShockAPI/Bouncer.cs

@@ -260,6 +260,13 @@ namespace TShockAPI
 
 			try
 			{
+				if (!TShock.Utils.TilePlacementValid(tileX, tileY))
+				{
+					TShock.Log.ConsoleDebug("Bouncer / OnTileEdit rejected from (tile placement valid) {0} {1} {2}", args.Player.Name, action, editData);
+					args.Handled = true;
+					return;
+				}
+
 				if (editData < 0 ||
 					((action == EditAction.PlaceTile || action == EditAction.ReplaceTile) && editData >= Main.maxTileSets) ||
 					((action == EditAction.PlaceWall || action == EditAction.ReplaceWall) && editData >= Main.maxWallTypes))
@@ -270,14 +277,6 @@ namespace TShockAPI
 					return;
 				}
 
-				if (!TShock.Utils.TilePlacementValid(tileX, tileY))
-				{
-					TShock.Log.ConsoleDebug("Bouncer / OnTileEdit rejected from (tile placement valid) {0} {1} {2}", args.Player.Name, action, editData);
-					args.Player.SendTileSquare(tileX, tileY, 1);
-					args.Handled = true;
-					return;
-				}
-
 				if (action == EditAction.KillTile && Main.tile[tileX, tileY].type == TileID.MagicalIceBlock)
 				{
 					TShock.Log.ConsoleDebug("Bouncer / OnTileEdit super accepted from (ice block) {0} {1} {2}", args.Player.Name, action, editData);
@@ -1654,6 +1653,13 @@ namespace TShockAPI
 			short type = args.Type;
 			short style = args.Style;
 
+			if (!TShock.Utils.TilePlacementValid(x, y))
+			{
+				TShock.Log.ConsoleDebug("Bouncer / OnPlaceObject rejected valid placements from {0}", args.Player.Name);
+				args.Handled = true;
+				return;
+			}
+
 			if (type < 0 || type >= Main.maxTileSets)
 			{
 				TShock.Log.ConsoleDebug("Bouncer / OnPlaceObject rejected out of bounds tile from {0}", args.Player.Name);
@@ -1702,14 +1708,6 @@ namespace TShockAPI
 				return;
 			}
 
-			if (!TShock.Utils.TilePlacementValid(x, y))
-			{
-				TShock.Log.ConsoleDebug("Bouncer / OnPlaceObject rejected valid placements from {0}", args.Player.Name);
-				args.Player.SendTileSquare(x, y, 1);
-				args.Handled = true;
-				return;
-			}
-
 			if (args.Player.Dead && TShock.Config.Settings.PreventDeadModification)
 			{
 				TShock.Log.ConsoleDebug("Bouncer / OnPlaceObject rejected dead people don't do things from {0}", args.Player.Name);
@@ -1801,6 +1799,13 @@ namespace TShockAPI
 		/// <param name="args">The packet arguments that the event has.</param>
 		internal void OnPlaceTileEntity(object sender, GetDataHandlers.PlaceTileEntityEventArgs args)
 		{
+			if (!TShock.Utils.TilePlacementValid(args.X, args.Y))
+			{
+				TShock.Log.ConsoleDebug("Bouncer / OnPlaceTileEntity rejected tile placement valid from {0}", args.Player.Name);
+				args.Handled = true;
+				return;
+			}
+
 			if (args.Player.IsBeingDisabled())
 			{
 				TShock.Log.ConsoleDebug("Bouncer / OnPlaceTileEntity rejected disabled from {0}", args.Player.Name);
@@ -1828,6 +1833,13 @@ namespace TShockAPI
 		/// <param name="args">The packet arguments that the event has.</param>
 		internal void OnPlaceItemFrame(object sender, GetDataHandlers.PlaceItemFrameEventArgs args)
 		{
+			if (!TShock.Utils.TilePlacementValid(args.X, args.Y))
+			{
+				TShock.Log.ConsoleDebug("Bouncer / OnPlaceItemFrame rejected tile placement valid from {0}", args.Player.Name);
+				args.Handled = true;
+				return;
+			}
+
 			if (args.Player.IsBeingDisabled())
 			{
 				TShock.Log.ConsoleDebug("Bouncer / OnPlaceItemFrame rejected disabled from {0}", args.Player.Name);
@@ -2129,6 +2141,13 @@ namespace TShockAPI
 		/// <param name="args"></param>
 		internal void OnFoodPlatterTryPlacing(object sender, GetDataHandlers.FoodPlatterTryPlacingEventArgs args)
 		{
+			if (!TShock.Utils.TilePlacementValid(args.TileX, args.TileY))
+			{
+				TShock.Log.ConsoleDebug("Bouncer / OnFoodPlatterTryPlacing rejected tile placement valid from {0}", args.Player.Name);
+				args.Handled = true;
+				return;
+			}
+
 			if ((args.Player.SelectedItem.type != args.ItemID && args.Player.ItemInHand.type != args.ItemID))
 			{
 				TShock.Log.ConsoleDebug("Bouncer / OnFoodPlatterTryPlacing rejected item not placed by hand from {0}", args.Player.Name);

TShockAPI/Handlers/SendTileRectHandler.cs

@@ -85,7 +85,7 @@ namespace TShockAPI.Handlers
 			// At this point we should send our state back to the client so they remain in sync with the server
 			if (args.Handled == true)
 			{
-				args.Player.SendTileRect(args.TileX, args.TileY, args.Width, args.Length);
+				TSPlayer.All.SendTileRect(args.TileX, args.TileY, args.Width, args.Length);
 				TShock.Log.ConsoleDebug("Bouncer / SendTileRect reimplemented from carbonara from {0}", args.Player.Name);
 			}
 		}

TShockAPI/Properties/AssemblyInfo.cs

@@ -53,5 +53,5 @@ using System.Runtime.InteropServices;
 // Also, be sure to release on github with the exact assembly version tag as below
 // so that the update manager works correctly (via the Github releases api and mimic)
 
-[assembly: AssemblyVersion("4.5.4")]
+[assembly: AssemblyVersion("4.5.5")]
-[assembly: AssemblyFileVersion("4.5.4")]
+[assembly: AssemblyFileVersion("4.5.5")]

TShockAPI/TShock.cs

@@ -58,7 +58,7 @@ namespace TShockAPI
 		/// <summary>VersionNum - The version number the TerrariaAPI will return back to the API. We just use the Assembly info.</summary>
 		public static readonly Version VersionNum = Assembly.GetExecutingAssembly().GetName().Version;
 		/// <summary>VersionCodename - The version codename is displayed when the server starts. Inspired by software codenames conventions.</summary>
-		public static readonly string VersionCodename = "Blood Moon edition";
+		public static readonly string VersionCodename = "Olympics maybe?";
 
 		/// <summary>SavePath - This is the path TShock saves its data in. This path is relative to the TerrariaServer.exe (not in ServerPlugins).</summary>
 		public static string SavePath = "tshock";