0001552: Injection and ",hide" exploit - SphereServer BugTracker

View Issue Details [ Jump to Notes ]

[ Issue History ] [ Print ]

Project

Category

View Status

Date Submitted

Last Update

0001552

SphereServer

executable - generic

public

17-11-08 17:43

22-04-14 18:31

Reporter

Coruja

Assigned To

Ben

Priority

normal

Severity

major

Reproducibility

always

Status

closed

Resolution

no change required

Platform

OS Version

Product Version

Target Version

Fixed in Version

Summary

0001552: Injection and ",hide" exploit

Description

,hide is a injection function that remove a item only on player screen, like "removefromview", but works only for this player.

And this is a problem, because ppl use this on house impassable items (crates, metal chests, kegs, etc) to walk over the "invisible" item. Yea, I don't know how, but the player can walk over the item, no matter if the player is the house owner or not.

Last week I jailed a player walking over a tower DOOR. He simply walked over the front door without open it :O
PS: This player doesn't have any access on the house, and can't open the door, but can walk throught the door using this exploit.

Maybe a return of injection exploits part 2? Or just a unfixed old injection exploit?

Tags

No tags attached.

Nightly Version

09-09-2008

Experimental Flags

DiagonalWalkCheck, NewPositionChecks, WalkCheck

Option Flags

OSIMultiSight

Internal Build Number

Attached Files

Relationships

Notes
(0000137) Coruja (developer) 17-11-08 17:49	Oh and ",hide" probably doesn't act like a normal "removefromview". The removefromview function remove the item on player screen but continue not allowing the player pass through the invisible item. But ,hide remove the item on screen but allow walk over it without problems.

(0000138) torfo (administrator) 29-11-08 19:20	Without any further infos it will be hard to fix it. If you have access to the injection DLL or a complete packetlog pls send it to any dev (e.g. torfo@uo.torfo.org) Do not post it here^^

(0000140) Balrog (reporter) 10-12-08 01:08	Does sphere check the walk packet when the player is walking over a dinamic item? You can't walk over multi walls if the server is configured OK, so you mustn't walk over a dinamic item that is suposed to block walk.

(0000142) Shadow_Dragon (developer) 22-12-08 08:47	Maybe, Bad tiledata?

(0000146) Invernizzi (reporter) 07-01-09 13:41	Plus, this command can be used on locked doors too.

(0002078) Ben (manager) 22-04-14 18:31	No one has complained about this in years... must not be a problem anymore.

Issue History
Date Modified	Username	Field	Change
17-11-08 17:43	Coruja	New Issue
17-11-08 17:43	Coruja	Nightly Version	=> 09-09-2008
17-11-08 17:43	Coruja	Experimental Flags	=> DiagonalWalkCheck, NewPositionChecks, WalkCheck
17-11-08 17:43	Coruja	Option Flags	=> OSIMultiSight
17-11-08 17:49	Coruja	Note Added: 0000137
29-11-08 19:20	torfo	Note Added: 0000138
10-12-08 01:08	Balrog	Note Added: 0000140
22-12-08 08:47	Shadow_Dragon	Note Added: 0000142
07-01-09 13:41	Invernizzi	Note Added: 0000146
22-04-14 18:31	Ben	Note Added: 0002078
22-04-14 18:31	Ben	Status	new => closed
22-04-14 18:31	Ben	Assigned To	=> Ben
22-04-14 18:31	Ben	Resolution	open => no change required