Preventing right-click exploit with Hydraulic/Muscle/Slider/Winch tool #1068

Merged
merged 4 commits into from Mar 22, 2016

Projects

None yet

4 participants

@Mista-Tea
Contributor

There's been a longstanding issue where players are able to right-click using these 4 tools and create a constraint between a prop they own (according to any arbitrary prop protection system) and a prop they don't own, thus allowing them to essentially take control of the constrained props via dupe, remover, etc.

This is because there is no additional CanTool check to see if the constraint can be made between the exploiter's prop and the prop in the 2nd trace. This pull request adds the additional CanTool check.

Before patch:

  1. Player right-clicks their prop.
  2. Server checks CanTool to see if the player can tool the prop they are looking at and returns true (they own the prop).
  3. Another trace is created pointing back toward the player
  4. A constraint is created between the entity in the 1st trace and the entity in the 2nd trace, regardless of owner.

After patch:

  1. Player right-clicks their prop.
  2. Server checks CanTool to see if the player can tool the prop they are looking at and returns true (they own the prop).
  3. Another trace is created pointing back toward the player
  4. Server checks CanTool to see if the player can tool the prop the 2nd trace found and returns false (they don't own the prop).
@thegrb93
Contributor
thegrb93 commented Oct 1, 2015

Cool. Never crossed my mind because every pp has a hack to counter this and its such an old bug, but now it looks like the hack can be removed. Good fix.

@0tt
Contributor
0tt commented Oct 17, 2015

👍

@robotboy655
Collaborator

Even though I do not like the solution, I don't see any other way, so EHHHHH

@robotboy655 robotboy655 merged commit 7ef1b34 into garrynewman:master Mar 22, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment