exploit fix, electric boogaloo : canister edition

[Walter0o]

024a0ba removed the exploit protection of canisters without replacement, this commit fixes that.

without this, anybody can open/close valves and all other forms of messing with any canister from anywhere.

ALWAYS keep in mind, NanoUI will update the fancy buttons CLIENTSIDE, that does NOT protect against exploits !

the actual buttonpush can still be spoofed to the server even if NanoUI disabled/hid/greyed-out/removed the button !

[Walter0o]

the same goes for non-NanoUI, standard html buttons/windows too, btw

[MistakeNot4892]

👍

[mwerezak]

From what I understand, Adjacent() is preferable to in_range() for mobs interacting with objects since it prevents using things through glass panels.

[mwerezak]

Actually, ClickOn() already handles adjacency, so Adjacent() may not be necessary, except for the weird case where you open the canister dialog and then move so that there is a glass panel between you and the canister. Probably not worth worrying about.

[Walter0o]

see my comment below, i thought i posted it in here.

[Walter0o]

@mwerezak , at the risk of coming off as a dick, did you not read the commit description i gave ?

HTML and NanoUI windows have literally NO exploit protection potentional whatsoever, they are clientside, them hiding and adding and removing and greying out buttons is eye-candy only !

this means if you dont have the object's menu and you are laying dead on the other side of the map on another z-level,
you can STILL spoof the buttonclick to the server anyway.

for example :
you being a mangled dead limbless corpse stuffed in a welded locker floating through space does not restrict you in any way to spoof the buttonpush to the locked turret control of the AI core,
telling it to switch to lethal lasers.
only the turret control's exploit checks and how it reacts to incoming commands will prevent it from executing your spoofed commands, nothing else.

you are right to argue Adjacent() might be better than in_range(), but not via ClickOn().
ClickOn() even after its adjancy checks will or will not eventually call the HTML or NanoUI window handlers, which means ClickOn() will do NOTHING to prevent exploits.

this commits seeks to restore a basic protection against exploiters being able to open canisters without being restricted by their distance to the object, death, handcuffs or whatever, so feel free to add more checks to those i restored or replace them with better versions, but there MUST be some in the Topic proc.

again, ANY windows and buttons, HTML or NanoUI, have ZERO exploit protection potentional, do not rely on them when you deal with exploit prevention, you HAVE to do that in the Topic proc NO MATTER WHAT !

almost all exploits i ever saw stem from devs not being regorous with this and failing to doublecheck other devs work.