| View Issue Details [ Jump to Notes ] | [ Issue History ] [ Print ] |
| ID | Project | Category | View Status | Date Submitted | Last Update |
| 0004067 | Zandronum | [All Projects] Bug | public | 2022-12-29 17:29 | 2024-01-01 01:39 |
|
| Reporter | Kaminsky | |
| Assigned To | Kaminsky | |
| Priority | high | Severity | major | Reproducibility | always |
| Status | resolved | Resolution | fixed | |
| Platform | | OS | | OS Version | |
| Product Version | 3.1 | |
| Target Version | 3.2 | Fixed in Version | 3.2 | |
|
| Summary | 0004067: Clients kicked by the server for wrong version/password can still trigger DISCONNECT scripts |
| Description | Clients who haven't fully connected to a server but are kicked for using the wrong version (e.g. connecting to a 3.2-alpha server with a 3.1 client) or connect password can still execute DISCONNECT ACS scripts. These scripts should only be executed if players that were already in the game (i.e. not a true spectator) leave. Clients that are still connecting to the server are obviously not in the game yet, so it shouldn't be executing when they disconnect.
This can be a problem for mods that use these script types, and in some cases exploitable. |
| Steps To Reproduce | 1. Host a server (either 3.1 or 3.2-alpha) with disconnecttest.wad loaded, and also set sv_password to something that isn't blank. If a player disconnects from the game, the message "Oh my god, a player left!" will be printed for everyone.
2. Have one client join the server with the correct version and password. Make sure they successfully connect to the server.
3. Have a second client join the server with the wrong version or password. They will be kicked before they connect, but the aforementioned message will still be printed, indicating that the script executed. |
| Additional Information | Thanks a lot to Langrenus for reporting the issue. |
|
| Attached Files |  disconnecttest.wad [^] (387 bytes) 2022-12-29 17:29 |
|
Chat on our Discord Server
Get the latest version: 3.1
Relationships 
Relationships 
(0022820)
(0022947)
ZDoom
Doom Wiki
id Software
Doomworld
Odamex
Doomseeker
Internet Doom Explorer
The Sentinel's Playground Servers