Skip to content

Fix daily challenge not querying beatmap properly#32596

Merged
smoogipoo merged 5 commits intoppy:masterfrom
bdach:fix-bogus-daily-challenge-lookup
Mar 27, 2025
Merged

Fix daily challenge not querying beatmap properly#32596
smoogipoo merged 5 commits intoppy:masterfrom
bdach:fix-bogus-daily-challenge-lookup

Conversation

@bdach
Copy link
Collaborator

@bdach bdach commented Mar 26, 2025

Noticed during review of #32571 (cc @smoogipoo).

The reproduction scenario is as follows:

  1. Download beatmap used in daily challenge
  2. Go to editor and modify it
  3. Go to daily challenge, wherein the availability tracker will notice the MD5 mismatch, block the start gameplay button, and require a redownload
  4. Redownload the beatmap
  5. Start gameplay
  6. Gameplay start will fail due to web not issuing a submission token because the attempt to start gameplay ended up using the modified version of the map from step (2) rather than the redownloaded original from step (4).

Thankfully, due to (6), this is not exploitable (so I'm not calling for a cavalry charge here), but nevertheless pretty bad.

Probably regressed somewhere around #31747 actually.

Not sure whether this requires tests or not, will attempt on request.

Noticed during review of ppy#32571.

The reproduction scenario is as follows:

1. Download beatmap used in daily challenge
2. Go to editor and modify it
3. Go to daily challenge, wherein the availability tracker will notice
   the MD5 mismatch, block the button, and require a redownload
4. Redownload the beatmap
5. Start gameplay
6. Gameplay start will fail due to web not issuing a submission token
   because the attempt to start gameplay ended up using the modified
   version of the map from step (2) rather than the redownloaded
   original from step (4).

Thankfully, due to (6), this is not exploitable, but nevertheless pretty
bad.

Probably regressed somewhere around
ppy#31747 actually.
@smoogipoo
Copy link
Contributor

Does this mean it's also an issue for playlists and multiplayer (new implementation)?

@bdach
Copy link
Collaborator Author

bdach commented Mar 26, 2025

For whatever reason it did not appear to be in testing, but I shall double check because I can't see why it would not be from these snippets...

@smoogipoo
Copy link
Contributor

smoogipoo commented Mar 26, 2025

Aside from the default values (from PlaylistItem / MultiplayerPlaylistItem directly), the user style also presents a bit of a problem because multiplayer only tracks the user's beatmap id and not their hash... E.g. ChangeUserStyle - this may actually need to be changed to a string?.

Score submission should be alright in either case because we create scores with both values.

Unless I'm missing something, does that sound about right?

@bdach bdach force-pushed the fix-bogus-daily-challenge-lookup branch from 6c378be to f3524ad Compare March 27, 2025 07:50
@bdach
Copy link
Collaborator Author

bdach commented Mar 27, 2025

(please disregard force push above, mis-pushed)

…aily challenge (and expand to other online play modes)
@bdach
Copy link
Collaborator Author

bdach commented Mar 27, 2025

Okay, to answer your questions properly:

Does this mean it's also an issue for playlists and multiplayer (new implementation)?

I dunno how I was testing this, but indeed it is an issue there also. I was perhaps misled by the fact that a lot of the screen looks correct because it's using mostly online metadata, but the issue does appear when you try to advance to gameplay.

Aside from the default values (from PlaylistItem / MultiplayerPlaylistItem directly), the user style also presents a bit of a problem because multiplayer only tracks the user's beatmap id and not their hash... E.g. ChangeUserStyle - this may actually need to be changed to a string?.

Score submission should be alright in either case because we create scores with both values.

Unless I'm missing something, does that sound about right?

Yes, score submission is not affected, and user style would be a problem. However, because we are protected from this server-side anyway, and as such this is mostly a client-side inconvenience (which is mostly inscrutable to end users), I'm kinda thinking that maybe we can get away with something like f736015 which is completely doable client-side and we don't have to involve freestyle into that conversation at all with that fix. Let me know what you think.

If you think that's acceptable then maybe we want to be applying that same MD5Hash == OnlineMD5Hash thing in

realm.Realm.All<BeatmapInfo>().Filter("OnlineID == $0 && MD5Hash == $1 && BeatmapSet.DeletePending == false", beatmap.OnlineID, beatmap.MD5Hash);

which would make testing this much easier too.

return;

var beatmap = beatmaps.QueryBeatmap(b => b.OnlineID == item.Beatmap.OnlineID);
var beatmap = beatmaps.QueryBeatmap($@"{nameof(BeatmapInfo.OnlineID)} = $0 AND {nameof(BeatmapInfo.MD5Hash)} = {nameof(BeatmapInfo.OnlineMD5Hash)}", item.Beatmap.OnlineID);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we should use == to keep things consistent?

smoogipoo
smoogipoo previously approved these changes Mar 27, 2025
@bdach
Copy link
Collaborator Author

bdach commented Mar 27, 2025

I've fixed tests more or less by applying local workarounds as necessary. OnlineMD5Hash is normally updated by the metadata lookup flows which kinda really can't be hooked in here any other way.

Also let me know if you'd want to see the following done:

If you think that's acceptable then maybe we want to be applying that same MD5Hash == OnlineMD5Hash thing in

realm.Realm.All<BeatmapInfo>().Filter("OnlineID == $0 && MD5Hash == $1 && BeatmapSet.DeletePending == false", beatmap.OnlineID, beatmap.MD5Hash);

which would make testing this much easier too.

because it's not clear to me whether I should follow up on that (proooobably in a separate PR?)

@smoogipoo
Copy link
Contributor

Fixes look fine to me. That followup sounds good to apply in a separate PR (just in case there's even more test breakage).

@smoogipoo smoogipoo merged commit b414ed0 into ppy:master Mar 27, 2025
10 checks passed
@bdach bdach deleted the fix-bogus-daily-challenge-lookup branch March 27, 2025 12:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

Comments