MantisBT - Zandronum
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0002120Zandronum[All Projects] Bugpublic2015-03-08 01:002015-03-08 04:51
Reporterhaxmurderer 
Assigned To 
PrioritynormalSeveritymajorReproducibilityalways
StatusnewResolutionopen 
PlatformMicrosoftOSWindowsOS VersionXP/Vista/7
Product Version1.3 
Target VersionFixed in Version 
Summary0002120: Persistent inventory / DB is always exploitable due to design limitations
DescriptionHi guys,

In Survivalism, I've had persistent inventory running pretty much since Zandronum 1.3 came out, and the basics have been working great. There's dozens of players who have persistent inventory on my server and have been playing for months.

One major problem that I can't figure out is how to prevent this exploit:

A player saves their inventory in-game, drops a bunch of items, reconnects, and then reloads their inventory. They now have all their old inventory plus the items they dropped.

I thought the solution would be to save the player's inventory in a DISCONNECT script, but the ZDoom wiki says, "Because the player has already left the game by the time this script is called, no actions can be taken on that player", therefore this solution won't work. If we changed the behaviour of DISCONNECT to allow access to the player momentarily, I'd be able to solve my problem.

I can't think of any other way around this. I believe we have to change something in Zandronum to fix this exploit. It's more important to me now because I've added an XP and leveling system to Survivalism that's also persistent.

Any ideas?

Thanks!
Steps To ReproduceDo a thought experiment:

A player saves their inventory in-game to the DB, drops a bunch of items, reconnects, and then loads their inventory from the DB. They now have all their old inventory plus the items they dropped.
Additional Information
TagsNo tags attached.
Relationships
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2015-03-08 01:00haxmurdererNew Issue
2015-03-08 02:56HypnotoadNote Added: 0011782

Notes
(0011782)
Hypnotoad   
2015-03-08 02:56   
I assume you're also using the accounts system. To write info associated with player accounts when they disconnect: store the account name of each player temporarily in a new namespace in the DB on join, with their player number as the key name. Then, on the disconnect script, simply use the player number that's passed to access the account name from the temp account names namespace, and write whatever you need to the database using this name.

But are you sure you can't just update the database every time a player drops their inventory?