kiwi can_grow() doesn't check permissions #52

SwissalpS commented 2026年06月05日 18:54:32 +02:00

This makes it a griefing vector. (tested and reported by Huhhila on Pandorabox)

[moretrees] uses core.spawn_tree(pos, model) which seems to work well with protections.
github.com/mt-mods/moretrees@bf28cd8e7c/init.lua (L216)

https://codeberg.org/tenplus1/farming/src/commit/7cc6c9c3ecece8b778c1a2e45f3501139548f721/crops/kiwi.lua#L120 This makes it a griefing vector. (tested and reported by Huhhila on Pandorabox) [moretrees] uses ```core.spawn_tree(pos, model)``` which seems to work well with protections. https://github.com/mt-mods/moretrees/blob/bf28cd8e7c74a0457e717e647c110470d7462035/init.lua#L216

tenplus1 commented 2026年06月06日 08:38:00 +02:00

Grow doesnt need permissions, a protection check is done when sapling is placed, and the schematic is made so that nothing can be replaced apart from the sapling itself when grown, so it cannot be used to grief.

Note: core.spawn_tree is used to spawn L-type decorations and not schematics.

Grow doesnt need permissions, a protection check is done when sapling is placed, and the schematic is made so that nothing can be replaced apart from the sapling itself when grown, so it cannot be used to grief. Note: core.spawn_tree is used to spawn L-type decorations and not schematics.

SwissalpS commented 2026年06月06日 10:06:35 +02:00

I happen to trust Huhhila, if they say they managed to destroy protected chest with contents, I believe them.

This may not be exclusive to kiwi, we are still testing with other trees and so far only kiwis have raised concern.

Attached a screen grab of a kiwi destroying a chest containing items and also destroying a rubber tree trunk. This without any protections in play.

I happen to trust Huhhila, if they say they managed to destroy protected chest with contents, I believe them. This may not be exclusive to kiwi, we are still testing with other trees and so far only kiwis have raised concern. Attached a screen grab of a kiwi destroying a chest containing items and also destroying a rubber tree trunk. This without any protections in play.

tenplus1 commented 2026年06月06日 10:24:04 +02:00

@SwissalpS - The latest upate fixed that issue by only force placing the bottom of the tree to replace sapling.

"No nodes were harmed in the making of this comment..."

@SwissalpS - The latest upate fixed that issue by only force placing the bottom of the tree to replace sapling. "No nodes were harmed in the making of this comment..."

SwissalpS commented 2026年06月06日 11:41:40 +02:00

7f12a2a667 doesn't stop destruction of nodes entirely. 2 nodes above the sapling is still vulnerable.

https://codeberg.org/tenplus1/farming/commit/7f12a2a6674cb67b141f06c448e46fd72da0d954 doesn't stop destruction of nodes entirely. 2 nodes above the sapling is still vulnerable.

SwissalpS commented 2026年06月06日 11:45:11 +02:00

BTW, local l isn't used anywhere in the scheme.

BTW, ```local l``` isn't used anywhere in the scheme.

tenplus1 commented 2026年06月06日 12:34:54 +02:00

Good eye, I never spotted that other T :) also using l for under leave randomness... Thanks :P

Good eye, I never spotted that other T :) also using l for under leave randomness... Thanks :P