MantisBT - Zandronum
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0002528Zandronum[All Projects] Suggestionpublic2015-11-18 22:062018-09-30 22:05
ReporterWaTaKiD 
Assigned ToDusk 
PriorityhighSeverityexploitReproducibilityN/A
StatusclosedResolutionfixed 
PlatformMicrosoftOSWindowsOS VersionXP/Vista/7
Product Version 
Target Version2.2Fixed in Version3.0 
Summary0002528: enforce the drop weapon check serverside
Description<Leonard> ok so there's a time limit and a cooperative check done at the same time but it's clientside only
<Leonard> I guess those need to be enforced on serverside

otherwise a modified client could bypass this and for example: drop weapons and pick up the map placed ones again for more ammo in a dm game, where players using a vanilla client cannot
Steps To Reproduce
Additional Information
TagsNo tags attached.
Relationships
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2015-11-18 22:06WaTaKiDNew Issue
2015-11-18 22:06WaTaKiDDescription Updatedbug_revision_view_page.php?rev_id=8248#r8248
2016-02-07 18:57DuskSeverityminor => exploit
2016-02-07 20:33LeonardNote Added: 0014388
2016-02-07 21:06Torr SamahoNote Added: 0014390
2016-02-08 04:16WaTaKiDNote Added: 0014392
2016-02-08 07:31DrinkyBirdNote Added: 0014393
2016-02-08 10:04DrinkyBirdNote Edited: 0014393bug_revision_view_page.php?bugnote_id=14393#r8685
2016-02-08 11:45WaTaKiDNote Added: 0014394
2016-02-08 12:09DuskAssigned To => Dusk
2016-02-08 12:09DuskStatusnew => assigned
2016-02-08 12:20WaTaKiDNote Edited: 0014394bug_revision_view_page.php?bugnote_id=14394#r8687
2016-02-10 15:14DuskNote Added: 0014414
2016-02-10 15:14DuskStatusassigned => needs review
2016-02-10 15:14DuskPrioritynormal => high
2016-02-10 20:14cobaltStatusneeds review => needs testing
2016-02-10 20:14cobaltTarget Version => 2.2
2016-02-10 20:14cobaltDescription Updatedbug_revision_view_page.php?rev_id=8715#r8715
2016-02-10 20:14cobaltNote Added: 0014417
2016-02-10 20:14cobaltNote Added: 0014418
2016-03-01 22:35WaTaKiDNote Added: 0014532
2016-03-01 22:35WaTaKiDStatusneeds testing => resolved
2016-03-01 22:35WaTaKiDResolutionopen => fixed
2016-03-01 22:35WaTaKiDFixed in Version => 3.0
2016-03-01 22:35WaTaKiDDescription Updatedbug_revision_view_page.php?rev_id=8798#r8798
2018-09-30 22:05Blzut3Statusresolved => closed

Notes
(0014388)
Leonard   
2016-02-07 20:33   
I might add that there's a ton of other checks like that which are only enforced on the clientside..
It's not the first time it happens and someone else already said this on the tracker.
(0014390)
Torr Samaho   
2016-02-07 21:06   
For this particular check, I'd think the client side check should simply be dropped. Not allowing dropping in non-coop modes doesn't make much sense now that we have sv_nodrop, which is already enforced on the server.
(0014392)
WaTaKiD   
2016-02-08 04:16   
Leonard: would you please elaborate on the tons of other checks? it'd be appreciated if you would help find and discuss them so as to improve zandronum overall

if u feel that any or all should go into a private note, ticket, or even a pm on the forums or irc, any is fine as long as we can show them to the devs and see what needs adjusting to ensure a better experience in the future
(0014393)
DrinkyBird   
2016-02-08 07:31   
(edited on: 2016-02-08 10:04)
I noticed that you don't need a custom client to avoid dropping weapons in competitive game modes, all you need to do is set sv_limitcommands to 0 on the client. sv_nodrop 1 on the server will prevent this, however.
(0014394)
WaTaKiD   
2016-02-08 11:45   
(edited on: 2016-02-08 12:20)
what AOSP says is true, however, sv_limitcommands is definitely not something that was disabled at the time this was found and reported, nor is it something that should be disabled in public servers due to how it can be used to really spam up the place and should instead be used with care like other debugging type commands (developer, sv_cheats, etc)

edit: as i reread AOSP's note, it is infact true that a client can set sv_limitcommands to false and drop weapons, regardless if the server has sv_limitcommands true or false, and that if the server has sv_nodrop set to true, then the client cannot drop a weapon
(0014414)
Dusk   
2016-02-10 15:14   
'https://bitbucket.org/Torr_Samaho/zandronum-stable/pull-requests/25 [^]'
(0014417)
cobalt   
2016-02-10 20:14   
Issue addressed by commit d31777cc56b1: Fixed: sv_limitcommands wasn't CVAR_SERVERINFO which allowed the client to change its value locally, addresses 2528
Committed by Teemu Piippo [Dusk] on Wednesday 31 December 1969 23:59:57

Changes in files:

 docs/zandronum-history.txt | 1 +
 src/sv_main.cpp | 2 +-
 2 files changed, 2 insertions(+), 1 deletions(-)
(0014418)
cobalt   
2016-02-10 20:14   
Issue addressed by commit 0f718f260358: Dropping is now allowed by default even in non-cooperative gamemodes, also addresses 2528
Committed by Teemu Piippo [Dusk] on Wednesday 31 December 1969 23:59:57

Changes in files:

 docs/zandronum-history.txt | 1 +
 src/cl_commands.cpp | 15 +++------------
 2 files changed, 4 insertions(+), 12 deletions(-)
(0014532)
WaTaKiD   
2016-03-01 22:35   
tested using 3.0-r160229-1221, as a client i was unable to change sv_limitcommands for myself

also i was able to drop weapons in every gamemode with sv_nodrop 0, and was unable to drop with sv_nodrop 1