From 2ef33f314c7e29c631fda34582a2a2e4a947c2d5 Mon Sep 17 00:00:00 2001 From: Ziggy Date: Tue, 28 Jun 2022 04:05:53 +0200 Subject: [PATCH] Security check on setcurrentskilltitle command, so a player must actually own the skill that they want to use the title for --- .../player/experience/skills/SkillService.java | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/main/java/com/projectswg/holocore/services/gameplay/player/experience/skills/SkillService.java b/src/main/java/com/projectswg/holocore/services/gameplay/player/experience/skills/SkillService.java index d4b0a62aa..0ba49aadb 100644 --- a/src/main/java/com/projectswg/holocore/services/gameplay/player/experience/skills/SkillService.java +++ b/src/main/java/com/projectswg/holocore/services/gameplay/player/experience/skills/SkillService.java @@ -9,6 +9,7 @@ import com.projectswg.holocore.resources.support.data.server_info.loader.DataLoa import com.projectswg.holocore.resources.support.data.server_info.loader.SkillLoader; import com.projectswg.holocore.resources.support.data.server_info.loader.SkillLoader.SkillInfo; import com.projectswg.holocore.resources.support.objects.swg.creature.CreatureObject; +import com.projectswg.holocore.resources.support.objects.swg.player.PlayerObject; import com.projectswg.holocore.services.gameplay.player.experience.*; import me.joshlarson.jlcommon.control.IntentHandler; import me.joshlarson.jlcommon.control.Service; @@ -109,7 +110,14 @@ public class SkillService extends Service { return; } - sti.getRequester().setTitle(title); + PlayerObject requester = sti.getRequester(); + + CreatureObject creatureObject = Objects.requireNonNull(requester.getOwner()).getCreatureObject(); + Set skills = creatureObject.getSkills(); + + if (skills.contains(title)) { + requester.setTitle(title); + } } @IntentHandler