From f8a5b0505ed957d67ed8df2af4308b8fe2ad0ed4 Mon Sep 17 00:00:00 2001 From: John <63141077+AconiteX@users.noreply.github.com> Date: Thu, 17 Jun 2021 03:13:04 -0400 Subject: [PATCH] Add Security for Open Data Container Requests --- .../src/shared/command/CommandCppFuncs.cpp | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/engine/server/library/serverGame/src/shared/command/CommandCppFuncs.cpp b/engine/server/library/serverGame/src/shared/command/CommandCppFuncs.cpp index 427f933c..949b5e23 100755 --- a/engine/server/library/serverGame/src/shared/command/CommandCppFuncs.cpp +++ b/engine/server/library/serverGame/src/shared/command/CommandCppFuncs.cpp @@ -3398,6 +3398,21 @@ static void commandFuncOpenContainer(Command const & cmd, NetworkId const &actor { return; } + + //-- if we are requesting to open an inventory, datapad, or bank, make sure it belongs to us or we're a CSR + //-- this provides better security for /editDatapad /editInventory and /editBank admin commands. + const uint32 crc = container->getTemplateCrc(); + if((player->isPlayerControlled()) && (crc == 2007924155 || crc == -1783727815 || crc == -172438875)) + { + Client * const clientObj = player->getClient(); + if(clientObj) + { + if(container->getOwnerId() != actor && !clientObj->isGod()) + { + return; + } + } + } //-- if they are opening a crafting station, what they really want is the hopper //-- but only if the object is not a volume container