your-land/bugtracker
your-land
/
bugtracker
44
20
Code Issues 2.5k Projects 2 Wiki

mrminer reports: digiliens adv touchscreen shou ... #4876

New Issue
Open
opened 2023-07-01 20:31:25 +00:00 by yourland-report · 17 comments
yourland-report commented 2023-07-01 20:31:25 +00:00
Member
Copy Link

mrminer reports a bug:

digiliens adv touchscreen should be craftable

Player position:

{
	y = 52,
	z = 378.73199462891,
	x = 2888.0480957031
}

Player look:

{
	y = 0.039957400411367,
	z = 0.43770712614059,
	x = 0.8982293009758
}

Player information:

{
	formspec_version = 6,
	lang_code = "",
	protocol_version = 42,
	minor = 7,
	state = "Active",
	version_string = "5.7.0",
	major = 5,
	max_rtt = 1.6180000305176,
	ip_version = 6,
	min_rtt = 0.1140000000596,
	avg_rtt = 0.12300000339746,
	min_jitter = 0,
	max_jitter = 1.4930000305176,
	avg_jitter = 0.0030000060796738,
	connection_uptime = 566,
	serialization_version = 29,
	patch = 0
}

Player meta:

{
	fields = {
		arenalib_infobox_arenaID = "0",
		["stamina:level"] = "12",
		xp = "58358",
		yl_commons_thankyou = "71",
		["stamina:exhaustion"] = "76.5",
		["hud_manager:choppy:waypoint_enabled"] = "y",
		digged_nodes = "128358",
		placed_nodes = "47715",
		died = "634",
		crafted = "29062",
		yl_commons_player_created = "1646186882",
		yl_commons_player_joined = "1688242939",
		["signslib:pos"] = "(2917,72,289)",
		["petz:old_override_table"] = "return {[\"new_move\"] = true, [\"jump\"] = 1.5, [\"gravity\"] = 1, [\"sneak_glitch\"] = false, [\"speed\"] = 2, [\"sneak\"] = true}",
		["petz:werewolf_clan_idx"] = "4",
		["unified_inventory:bags"] = "return {\"unified_inventory:bag_large\", \"unified_inventory:bag_large\", \"unified_inventory:bag_large\", \"unified_inventory:bag_large\"}",
		repellant = "0",
		["ocean_build.last_warning"] = "1.6733e+09",
		["ocean_build.forbidden"] = "true",
		["ocean_build.ocean_built"] = "12",
		["3d_armor_inventory"] = "return {\"3d_armor:helmet_nether 1 4400\", \"3d_armor:chestplate_crystal 1 4400\", \"3d_armor:leggings_crystal 1 4400\", \"3d_armor:boots_crystal 1 4400\", \"shields:shield_crystal 1 4400\", \"\"}",
		["petz:werewolf"] = "0",
		jointime = "1646186882",
		bitten = "0",
		punch_count = "22983",
		partychat = "party",
		inflicted_damage = "476624",
		yl_church = "return {[\"last_heal\"] = 1677356984, [\"last_death\"] = {[\"y\"] = 18, [\"z\"] = 1173, [\"x\"] = 1986}, [\"last_death_portal\"] = 1687820074}",
		["petz:lycanthropy"] = "0",
		played_time = "3286685",
		hud_state = "on",
		["stamina:poisoned"] = "no",
		["petz:werewolf_vignette_id"] = "19",
		arenalib_watchID = "0"
	}
}

Log identifier


[MOD] yl_report log identifier = rZcPsu2L2LFtJHDqgy4QEPPDau23yDxu

Profiler save:

profile-20230701T203125.json_prettyEE

Status:

# Server: version: 5.7.0-yl-thx-tmm | game: Minetest Game | uptime: 2d 12h 28min 42s | max lag: 0.534s | clients (23/52): AliasAlreadyTaken, Bailiff, Beth75, betzi, Boot, darealbang, daydream, DragonWrangler1, Ernle1, FireThatFollows, flux, goiaba, HorusDamocles, JeCel, mrminer, NodeBreaker, Ravise, Sacrementum, Service, Shadow, shanish2, whosit, Zerko

Teleport command:

/teleport xyz 2888 52 379

Compass command:

/give_compass Construction rZcPsu2L2LFtJHDqgy4QEPPDau23yDxu D2691E 2888 52 379
mrminer reports a bug: > digiliens adv touchscreen should be craftable Player position: ``` { y = 52, z = 378.73199462891, x = 2888.0480957031 } ``` Player look: ``` { y = 0.039957400411367, z = 0.43770712614059, x = 0.8982293009758 } ``` Player information: ``` { formspec_version = 6, lang_code = "", protocol_version = 42, minor = 7, state = "Active", version_string = "5.7.0", major = 5, max_rtt = 1.6180000305176, ip_version = 6, min_rtt = 0.1140000000596, avg_rtt = 0.12300000339746, min_jitter = 0, max_jitter = 1.4930000305176, avg_jitter = 0.0030000060796738, connection_uptime = 566, serialization_version = 29, patch = 0 } ``` Player meta: ``` { fields = { arenalib_infobox_arenaID = "0", ["stamina:level"] = "12", xp = "58358", yl_commons_thankyou = "71", ["stamina:exhaustion"] = "76.5", ["hud_manager:choppy:waypoint_enabled"] = "y", digged_nodes = "128358", placed_nodes = "47715", died = "634", crafted = "29062", yl_commons_player_created = "1646186882", yl_commons_player_joined = "1688242939", ["signslib:pos"] = "(2917,72,289)", ["petz:old_override_table"] = "return {[\"new_move\"] = true, [\"jump\"] = 1.5, [\"gravity\"] = 1, [\"sneak_glitch\"] = false, [\"speed\"] = 2, [\"sneak\"] = true}", ["petz:werewolf_clan_idx"] = "4", ["unified_inventory:bags"] = "return {\"unified_inventory:bag_large\", \"unified_inventory:bag_large\", \"unified_inventory:bag_large\", \"unified_inventory:bag_large\"}", repellant = "0", ["ocean_build.last_warning"] = "1.6733e+09", ["ocean_build.forbidden"] = "true", ["ocean_build.ocean_built"] = "12", ["3d_armor_inventory"] = "return {\"3d_armor:helmet_nether 1 4400\", \"3d_armor:chestplate_crystal 1 4400\", \"3d_armor:leggings_crystal 1 4400\", \"3d_armor:boots_crystal 1 4400\", \"shields:shield_crystal 1 4400\", \"\"}", ["petz:werewolf"] = "0", jointime = "1646186882", bitten = "0", punch_count = "22983", partychat = "party", inflicted_damage = "476624", yl_church = "return {[\"last_heal\"] = 1677356984, [\"last_death\"] = {[\"y\"] = 18, [\"z\"] = 1173, [\"x\"] = 1986}, [\"last_death_portal\"] = 1687820074}", ["petz:lycanthropy"] = "0", played_time = "3286685", hud_state = "on", ["stamina:poisoned"] = "no", ["petz:werewolf_vignette_id"] = "19", arenalib_watchID = "0" } } ``` Log identifier ``` [MOD] yl_report log identifier = rZcPsu2L2LFtJHDqgy4QEPPDau23yDxu ``` Profiler save: ``` profile-20230701T203125.json_prettyEE ``` Status: ``` # Server: version: 5.7.0-yl-thx-tmm | game: Minetest Game | uptime: 2d 12h 28min 42s | max lag: 0.534s | clients (23/52): AliasAlreadyTaken, Bailiff, Beth75, betzi, Boot, darealbang, daydream, DragonWrangler1, Ernle1, FireThatFollows, flux, goiaba, HorusDamocles, JeCel, mrminer, NodeBreaker, Ravise, Sacrementum, Service, Shadow, shanish2, whosit, Zerko ``` Teleport command: ``` /teleport xyz 2888 52 379 ``` Compass command: ``` /give_compass Construction rZcPsu2L2LFtJHDqgy4QEPPDau23yDxu D2691E 2888 52 379 ```
AliasAlreadyTaken was assigned by yourland-report 2023-07-01 20:31:25 +00:00
AliasAlreadyTaken added the
1. kind/enhancement
1. kind/balancing
 labels 2023-07-01 20:48:13 +00:00
AliasAlreadyTaken commented 2023-07-01 20:49:09 +00:00
Owner
Copy Link

What does the advanced touchscreen do, in contrast to the normal one?

What does the advanced touchscreen do, in contrast to the normal one?
AliasAlreadyTaken added the
4. step/help wanted
 label 2023-07-01 20:49:16 +00:00
whosit commented 2023-07-01 21:26:47 +00:00
Member
Copy Link
	if node.name == "digistuff:advtouchscreen" then
		if type(msg) == "string" then meta:set_string("formspec",msg) end
	else

Allows to directly set the node formspec... could be exploited in some way probably? Not sure how exactly.

```lua if node.name == "digistuff:advtouchscreen" then if type(msg) == "string" then meta:set_string("formspec",msg) end else ``` Allows to directly set the node formspec... could be exploited in some way probably? Not sure how exactly.
niceride commented 2023-07-03 07:08:51 +00:00
Copy Link
	if node.name == "digistuff:advtouchscreen" then
		if type(msg) == "string" then meta:set_string("formspec",msg) end
	else

Allows to directly set the node formspec... could be exploited in some way probably? Not sure how exactly.

Note this is aliased in [https://github.com/mt-mods/digistuff]:

touchscreen.lua:266:minetest.register_alias("digistuff:advtouchscreen", "digistuff:touchscreen")

And I guess what is upstream [https://cheapiesystems.com/git/digistuff] has the extra functionality.

I find a forum thread that does show a direct comparison of touchscreen vs adv touchscreen for setup, at [https://content.minetest.net/threads/719/#reply-3978].

Also reference [https://luk3yx.gitlab.io/minetest-formspec-editor/] for a WYSIWYG formspec designer web app.

> ```lua > if node.name == "digistuff:advtouchscreen" then > if type(msg) == "string" then meta:set_string("formspec",msg) end > else > ``` > Allows to directly set the node formspec... could be exploited in some way probably? Not sure how exactly. Note this is aliased in [https://github.com/mt-mods/digistuff]: ``` touchscreen.lua:266:minetest.register_alias("digistuff:advtouchscreen", "digistuff:touchscreen") ``` And I guess what is upstream [https://cheapiesystems.com/git/digistuff] has the extra functionality. I find a forum thread that does show a direct comparison of touchscreen vs adv touchscreen for setup, at [https://content.minetest.net/threads/719/#reply-3978]. Also reference [https://luk3yx.gitlab.io/minetest-formspec-editor/] for a WYSIWYG formspec designer web app.
flux commented 2023-07-04 00:16:50 +00:00
Member
Copy Link
	if node.name == "digistuff:advtouchscreen" then
		if type(msg) == "string" then meta:set_string("formspec",msg) end
	else

Allows to directly set the node formspec... could be exploited in some way probably? Not sure how exactly.

that's rather dangerous, hostile formspecs can cause client crashes or display arbitrary images

> ```lua > if node.name == "digistuff:advtouchscreen" then > if type(msg) == "string" then meta:set_string("formspec",msg) end > else > ``` > Allows to directly set the node formspec... could be exploited in some way probably? Not sure how exactly. that's rather dangerous, hostile formspecs can cause client crashes or display arbitrary images
AliasAlreadyTaken commented 2023-07-04 01:25:12 +00:00
Owner
Copy Link

Does msg come unescaped from userinput? Could they call any function in that?

Does msg come unescaped from userinput? Could they call any function in that?
whosit commented 2023-07-04 05:31:03 +00:00
Member
Copy Link

You can set it to arbitrary string via digilines.
https://cheapiesystems.com/git/digistuff/tree/touchscreen.lua#n258
Not sure about executing code, but via that formspec you have access to this:

Inventory locations

    "context": Selected node metadata (deprecated: "current_name")
    "current_player": Player to whom the menu is shown
    "player:<name>": Any player
    "nodemeta:<X>,<Y>,<Z>": Any node metadata
    "detached:<name>": A detached inventory
You can set it to arbitrary string via digilines. https://cheapiesystems.com/git/digistuff/tree/touchscreen.lua#n258 Not sure about executing code, but via that formspec you have access to this: ``` Inventory locations "context": Selected node metadata (deprecated: "current_name") "current_player": Player to whom the menu is shown "player:<name>": Any player "nodemeta:<X>,<Y>,<Z>": Any node metadata "detached:<name>": A detached inventory ```
AliasAlreadyTaken commented 2023-07-04 17:16:44 +00:00
Owner
Copy Link

Any node metadata ????
A detached inventory ????

Cuurent player as in "the object ref" ??

Any node metadata ???? A detached inventory ???? Cuurent player as in "the object ref" ??
whosit commented 2023-07-04 17:24:59 +00:00
Member
Copy Link

No, you can just create a formspec of all those inventories... it would still call all the callbacks for them though, so maybe even not as catastrophic for everything X)
But yeah, that's why it's not craftable probably :p

No, you can just create a formspec of all those inventories... it would still call all the callbacks for them though, so maybe even not as catastrophic for everything X) But yeah, that's why it's not craftable probably :p
flux commented 2023-07-05 02:31:12 +00:00
Member
Copy Link

Any node metadata ????
A detached inventory ????

Cuurent player as in "the object ref" ??

right, this is scary. it'd let you see any inventory in the game, and interact w/ any of them if the callbacks aren't restrictive enough. at the very least, it'd let you take stuff out of any of your chests anywhere in the world.

> Any node metadata ???? > A detached inventory ???? > > Cuurent player as in "the object ref" ?? right, this is scary. it'd let you see any inventory in the game, and interact w/ any of them if the callbacks aren't restrictive enough. at the very least, it'd let you take stuff out of any of your chests anywhere in the world.
AliasAlreadyTaken commented 2023-07-05 16:09:15 +00:00
Owner
Copy Link

Can we make sure the normal touchscreen does not have those "features" ?

Can we make sure the normal touchscreen does not have those "features" ?
sixer commented 2023-07-05 20:44:02 +00:00
Copy Link

right, this is scary. it'd let you see any inventory in the game, and interact w/ any of them if the callbacks aren't restrictive enough. at the very least, it'd let you take stuff out of any of your chests anywhere in the world.

wouldn't the anticheat prevent that, as you are interacting with inventory from more than allowed distance?

> right, this is scary. it'd let you see any inventory in the game, and interact w/ any of them if the callbacks aren't restrictive enough. at the very least, it'd let you take stuff out of any of your chests anywhere in the world. wouldn't the anticheat prevent that, as you are interacting with inventory from more than allowed distance?
flux commented 2023-07-05 22:28:53 +00:00
Member
Copy Link

wouldn't the anticheat prevent that, as you are interacting with inventory from more than allowed distance?

hmmm i thought it just blocked dig/place and left-click/right-click, possibly it also blocks interact w/ node inventories from a distance? but i don't think it'd block interacting w/ player or detached inventories from a distance?

> wouldn't the anticheat prevent that, as you are interacting with inventory from more than allowed distance? hmmm i thought it just blocked dig/place and left-click/right-click, possibly it also blocks interact w/ node inventories from a distance? but i don't think it'd block interacting w/ player or detached inventories from a distance?
whosit commented 2023-07-10 09:41:42 +00:00
Member
Copy Link

Did some experiments:

  • yes, I can see any node inventory (even of a locked chest not owned by me)
  • yes, I can see other player's armor inventory, no, I can't interact
  • no I can't take stuff from locked chest not owned by me
  • no I can't take stuff from a chest that I can access normally if it's too far
  • no I can't see another player's inv, probably because server does not send it to me?
  • no, I can't see player's bags contents
  • no, can't create new inventories in random nodes

So, this is not catastrophic, but if inventory does not have right callbacks, can be exploited. Anyway, digistuff:advtouchscreen should not be craftable and accessible to random people.

I think we can close this as wontfix.

Did some experiments: - yes, I can see any node inventory (even of a locked chest not owned by me) - yes, I can see other player's armor inventory, no, I can't interact - no I can't take stuff from locked chest not owned by me - no I can't take stuff from a chest that I _can_ access normally if it's too far - no I can't see another player's inv, probably because server does not send it to me? - no, I can't see player's bags contents - no, can't create new inventories in random nodes So, this is not catastrophic, but if inventory does not have right callbacks, can be exploited. Anyway, `digistuff:advtouchscreen` should not be craftable and accessible to random people. I think we can close this as `wontfix`.
👍 1
niceride commented 2023-07-10 18:50:35 +00:00
Copy Link

Is there any useful case of this for developing Your Land? If not, then alias it away as in the mt-mods repo to avoid accidental use.

Is there any useful case of this for developing Your Land? If not, then alias it away as in the mt-mods repo to avoid accidental use.
flux commented 2023-07-10 22:29:35 +00:00
Member
Copy Link

Is there any useful case of this for developing Your Land? If not, then alias it away as in the mt-mods repo to avoid accidental use.

not that i can think of. if we want to show custom formspec, we can just write a mod.

> Is there any useful case of this for developing Your Land? If not, then alias it away as in the mt-mods repo to avoid accidental use. not that i can think of. if we want to show custom formspec, we can just write a mod.
flux commented 2024-01-08 04:00:50 +00:00
Member
Copy Link

vote to make this staff-only, ASAP.

vote to make this staff-only, ASAP.
flux commented 2024-01-08 04:06:28 +00:00
Member
Copy Link

i've taken the initiative to gate this on staff priv. if i'm mistaken, it's easy to reverse e84490d36b

i've taken the initiative to gate this on staff priv. if i'm mistaken, it's easy to reverse https://gitea.your-land.de/your-land/mese_restriction/commit/e84490d36bc886380d2678f5e02a597d61dcab9b
👍 1
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
1. kind/balancing

Depends on balancing

  
1. kind/breaking

something that alters or disables an existing game mechanic

  
1. kind/bug

Something is not working

  
1. kind/construction

A build needs fixing

  
1. kind/documentation

Needs proper documentation

  
1. kind/enhancement

New feature

  
1. kind/griefing

players despoiling builds or nature

  
1. kind/invalid

Not a valid report, e.g. created by mistake with no content.

  
1. kind/meme

issue is mostly a joke

  
1. kind/node limit

something which works for or against the node limit

  
1. kind/other

Something not within the other kinds

  
1. kind/protocol

something concerning how staff should react to player requests, or how players should treat each other

  
2. prio/controversial

not likely to happen w/out a lot of discussion

  
2. prio/critical

Very important

  
2. prio/elevated

something players are eager to have fixed

  
2. prio/good first issue

the resolution to this is could be done by a new minetest contributor, who doesn't yet understand the mod ecosystem

  
2. prio/interesting

one of us has real interest in getting this implemented or fixed. however, more research might be needed.

  
2. prio/low

Not so important

  
3. source/art

art needs to be created or found for this to exist. includes sound, 3d modelling, and in-game building.

  
3. source/client

Issue is with the minetest client, or with player client configuration or the technical details of their setup

  
3. source/engine

Issue is due to a bug or feature of the minetest engine

  
3. source/ingame

Problem and solution exist in-game, e.g. builds or player moderation

  
3. source/integration

Two or more nonbuggy mechanics conflict, or our attempts to rectify conflicting mechanics have created a new bug

  
3. source/lag

A problem which is caused or made worse by lag, due to server processing issues, client processing issues, or network issues

  
3. source/license

A licensing problem is involved

  
3. source/mod upstream

Problem is upstream (not engine/client)

  
3. source/unknown

   
3. source/website

Affects the website

  
4. step/approved

Alias has approved this feature, someone should implement it

  
4. step/at work

Being worked on

  
4. step/blocked

we plan to do this, but other work has to be finished first

  
4. step/discussion

issue is under discussion, a solution has not been dictated or agreed upon

  
4. step/help wanted

Need some help

  
4. step/needs confirmation

   
4. step/partially fixed

this is mitigated or partially solved, but more work needs to be done

  
4. step/question

More information is needed

  
4. step/ready to deploy

has been QA tested by another person. has no outstanding issues. might be installed on prod, but needs final testing

  
4. step/ready to QA test

the code is supposedly fixed, but needs to be tested.

  
4. step/want approval

Someone can quickly implement this if Alias approves the change/feature

  
5. result/cannot reproduce

   
5. result/duplicate

This issue or pull request already exists

  
5. result/fixed

problem is fixed

  
5. result/maybe

not planned currently, but maybe some day

  
5. result/wontfix

the reported issue won't be changed, whether it's intentional or not.

  
ugh/petz

yet another petz bugz.

  
ugh/QA main

That's something we can only wait and see whether it hapens again: On the main server

  
ugh/QA NOK

Fix didn't yield the expected results

  
ugh/QA OK

tested

No Label
1. kind/balancing
1. kind/breaking
1. kind/bug
1. kind/construction
1. kind/documentation
1. kind/enhancement
1. kind/griefing
1. kind/invalid
1. kind/meme
1. kind/node limit
1. kind/other
1. kind/protocol
2. prio/controversial
2. prio/critical
2. prio/elevated
2. prio/good first issue
2. prio/interesting
2. prio/low
3. source/art
3. source/client
3. source/engine
3. source/ingame
3. source/integration
3. source/lag
3. source/license
3. source/mod upstream
3. source/unknown
3. source/website
4. step/approved
4. step/at work
4. step/blocked
4. step/discussion
4. step/help wanted
4. step/needs confirmation
4. step/partially fixed
4. step/question
4. step/ready to deploy
4. step/ready to QA test
4. step/want approval
5. result/cannot reproduce
5. result/duplicate
5. result/fixed
5. result/maybe
5. result/wontfix
ugh/petz
ugh/QA main
ugh/QA NOK
ugh/QA OK
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
AliasAlreadyTaken
6 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: your-land/bugtracker#4876
No description provided.
Delete Branch "%!s(<nil>)"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?