Coordinate exploit in signs and chests. #996

New Issue

cora · 2021-01-22T11:57:44+01:00

cora commented

2021-01-22 11:57:44 +01:00

Yesterday Clamity player anon5 discovered a coordinate exploit caused by the mcl_signs and mcl_chests mod both of which send the coords on being broken to all players. It was fixed on Clamity anarchy within hours.

chests work analogous even though somewhat more complex. I'll have emilia send you the full patch once she's up. this is the patch for signs:

in MineClone2/mods/ITEMS/mcl_signs/init.lua line 198

    local players = minetest.get_connected_players()
    for p=1, #players do
        minetest.close_formspec(players[p]:get_player_name(), "mcl_signs:set_text_"..pos.x.."_"..pos.y.."_"..pos.z)
    end


->

    local players = minetest.get_connected_players()
    for p=1, #players do
        if vector.distance(players[p]:get_pos(), pos) <= ANTICHEAT_RANGE then
            minetest.close_formspec(players[p]:get_player_name(), "mcl_signs:set_text_"..pos.x.."_"..pos.y.."_"..pos.z)
        end
    end

All credit goes to anon5 for finding it, emilia for patching it and Strychten/LennartPoettering for applying the fixes on Clamity.

Yesterday Clamity player anon5 discovered a coordinate exploit caused by the mcl_signs and mcl_chests mod both of which send the coords on being broken to all players. It was fixed on Clamity anarchy within hours. chests work analogous even though somewhat more complex. I'll have emilia send you the full patch once she's up. this is the patch for signs: in MineClone2/mods/ITEMS/mcl_signs/init.lua line 198 ``` local players = minetest.get_connected_players() for p=1, #players do minetest.close_formspec(players[p]:get_player_name(), "mcl_signs:set_text_"..pos.x.."_"..pos.y.."_"..pos.z) end -> local players = minetest.get_connected_players() for p=1, #players do if vector.distance(players[p]:get_pos(), pos) <= ANTICHEAT_RANGE then minetest.close_formspec(players[p]:get_player_name(), "mcl_signs:set_text_"..pos.x.."_"..pos.y.."_"..pos.z) end end ``` All credit goes to anon5 for finding it, emilia for patching it and Strychten/LennartPoettering for applying the fixes on Clamity.

👍 2

cora changed title from ~~Coordinate explloit in signs and chests.~~ to Coordinate exploit in signs and chests.

2021-01-22 11:58:03 +01:00

LizzyFleckenstein03 added the

bug

#P2: HIGH

labels 2021-01-22 12:58:29 +01:00

kay27 added the

nodes

label 2021-01-22 17:16:07 +01:00

kay27 commented

2021-01-22 17:16:58 +01:00

@cora Thanks so much for the notification. The patch looks good, I would like to merge it ASAP. What value would you recommend as ANTICHEAT_RANGE?

@cora Thanks so much for the notification. The patch looks good, I would like to merge it ASAP. What value would you recommend as ```ANTICHEAT_RANGE```?

kay27 added the

contribution inside

label 2021-01-22 17:17:16 +01:00

cora commented

2021-01-22 17:53:51 +01:00

I think we used 20 although even like 200 would totally be fine. I mean if the player is in rendering distance anyways it doesnt matter.

I have sent fleckenstein the full patch on discord. Luckily discords Upload thingy is pretty broken so i can just paste the link here ( chests need to be changed for this too ).

https://cdn.discordapp.com/attachments/801928118553018409/802205417862070342/patched.zip

I think we used 20 although even like 200 would totally be fine. I mean if the player is in rendering distance anyways it doesnt matter. I have sent fleckenstein the full patch on discord. Luckily discords Upload thingy is pretty broken so i can just paste the link here ( chests need to be changed for this too ). https://cdn.discordapp.com/attachments/801928118553018409/802205417862070342/patched.zip

kay27 referenced this issue from a commit

2021-01-22 18:43:27 +01:00

Fix https://git.minetest.land/Wuzzy/MineClone2/issues/996 Coordinate exploit in signs and chests, sent by @cora

kay27 closed this issue

2021-01-22 18:43:30 +01:00

kay27 commented

2021-01-22 18:51:06 +01:00

Hm, it has been closed automatically.
Feel free to reopen if something is wrong.
Many thanks!

Hm, it has been closed automatically. Feel free to reopen if something is wrong. Many thanks!

cora commented

2021-01-22 23:04:52 +01:00

no. looks good. thanks for the quick merge.