-
-
Notifications
You must be signed in to change notification settings - Fork 496
Added server side weapon related checks #3272
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Added server side weapon related checks #3272
Conversation
...g, and don't send potentially incorrect weapon data
So that was the problem all this time along. Lets hope this gets merged asap.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm :shipit:
Seems to keep happening to some extent. Version r22335 (Linux x64).
Useful information:
- The server knows the amount of bullets the user has in the slot, but returns 0 as a weapon.
- The server does not know when the player is shooting ("onPlayerWeaponFire" is not working, probably because weapon == 0).
That's about it.
What about explosions/damage caused by those shots (rpgs for example)?
We should stop those from being relayed too (if not already, not sure how the weapon sync works).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
is this intentional?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think it would be nice to add a comment explaining what could cause this (Cheaters, etc).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think it would be nice to add a comment explaining what could cause this (Cheaters, etc).
The reasoning for both of these changes has to do with people running hacks and/or Lua injectors client sided. In cases like these (which I've verified with a client running such cheats) clients will trigger puresync packets and/or bullet sync packets for weapons the player doesn't actually have.
While the server doesn't process these puresync packets, they still relay them to other players. Meaning these weapons are visible to other players (even though according to the server the player will not have the weapons).
For the bullet sync packet the server would blindly forward them, meaning a compromised client would be able to fire any weapon, without even having that weapon.
This PR aims to add two relatively simple checks to prevent this from happening.