Administrator reports: NPCs are said to be able to se ... #7568

New Issue

yourland-report · 2024-10-29T04:04:04+01:00

yourland-report commented

2024-10-29 04:04:04 +01:00

Administrator reports a bug:

NPCs are said to be able to set any metadata on items. That means every NPC owner could easily change "X won bronze Medal" to "X won Gold medal". Remove this option or allow only privileged use it

Player position:

{
	z = 1009.924987793,
	x = 2838.12109375,
	y = 13.933000564575
}

Player look:

{
	z = 0.91664451360703,
	x = 0.36403581500053,
	y = -0.16504760086536
}

Player information:

{
	formspec_version = 7,
	state = "Active",
	protocol_version = 43,
	version_string = "5.10.0-dev-1037ee2a5",
	max_rtt = 0.13199999928474,
	ip_version = 6,
	min_rtt = 0.016000000759959,
	min_jitter = 0,
	major = 5,
	avg_jitter = 0,
	connection_uptime = 1380,
	serialization_version = 29,
	patch = 0,
	max_jitter = 0.11599999666214,
	lang_code = "de",
	minor = 10,
	avg_rtt = 0.017000000923872
}

Player meta:

{
	fields = {
		lagometer = "1",
		yl_church = "return {[\"last_death\"] = {[\"y\"] = 54, [\"x\"] = -3844, [\"z\"] = -5201}}",
		arenalib_infobox_arenaID = "0",
		hud_state = "on",
		repellant = "0",
		yl_commons_player_joined = "1730169666",
		["signslib:pos"] = "(1982,15,1174)",
		yl_commons_thankyou = "20",
		["unified_inventory:bags"] = "return {\"unified_inventory:bag_large\", \"unified_inventory:bag_large\", \"unified_inventory:bag_large\", \"unified_inventory:bag_large\"}",
		inflicted_damage = "20714",
		crafted = "196",
		bitten = "0",
		played_time = "5085141",
		["stamina:level"] = "0",
		["ocean_build.last_warning"] = "1705058032",
		punch_count = "791",
		["ocean_build.ocean_built"] = "4",
		["stamina:exhaustion"] = "146.5",
		xp = "0",
		["hud_manager:spawnit:hud_enabled"] = "y",
		died = "185",
		["sethome:home"] = "(2218.833984375,40.9880027771,981.63397216797)",
		digged_nodes = "78520",
		placed_nodes = "127356",
		["3d_armor_inventory"] = "return {\"\", \"\", \"\", \"\", \"\", \"\"}",
		["ethereal:fly_timer"] = "-99"
	}
}

Log identifier


[MOD] yl_report log identifier = 78z1iTu6uzJmvYWEgGXk3GNmRWwtT1xU

Profiler save:

profile-20241029T030404.json_prettyEE

Status:

# Server: version: 5.8.0-yl-debug | game: Minetest Game | uptime: 8d 19h 42min 5s | max lag: 2.56s | clients (16/52): Administrator, AliasAlreadyTaken, Bailiff, BebopJunkie, Crafter_Maniac, DanteLives, daydream, DragonWrangler1, flux, gianlp, Keya, nakama-ta, Service, tagtraum, toddie, ZiViZ

Teleport command:

/teleport xyz 2838 14 1010

Compass command:

/give_compass Construction 78z1iTu6uzJmvYWEgGXk3GNmRWwtT1xU D2691E 2838 14 1010

Administrator reports a bug: > NPCs are said to be able to set any metadata on items. That means every NPC owner could easily change "X won bronze Medal" to "X won Gold medal". Remove this option or allow only privileged use it Player position: ``` { z = 1009.924987793, x = 2838.12109375, y = 13.933000564575 } ``` Player look: ``` { z = 0.91664451360703, x = 0.36403581500053, y = -0.16504760086536 } ``` Player information: ``` { formspec_version = 7, state = "Active", protocol_version = 43, version_string = "5.10.0-dev-1037ee2a5", max_rtt = 0.13199999928474, ip_version = 6, min_rtt = 0.016000000759959, min_jitter = 0, major = 5, avg_jitter = 0, connection_uptime = 1380, serialization_version = 29, patch = 0, max_jitter = 0.11599999666214, lang_code = "de", minor = 10, avg_rtt = 0.017000000923872 } ``` Player meta: ``` { fields = { lagometer = "1", yl_church = "return {[\"last_death\"] = {[\"y\"] = 54, [\"x\"] = -3844, [\"z\"] = -5201}}", arenalib_infobox_arenaID = "0", hud_state = "on", repellant = "0", yl_commons_player_joined = "1730169666", ["signslib:pos"] = "(1982,15,1174)", yl_commons_thankyou = "20", ["unified_inventory:bags"] = "return {\"unified_inventory:bag_large\", \"unified_inventory:bag_large\", \"unified_inventory:bag_large\", \"unified_inventory:bag_large\"}", inflicted_damage = "20714", crafted = "196", bitten = "0", played_time = "5085141", ["stamina:level"] = "0", ["ocean_build.last_warning"] = "1705058032", punch_count = "791", ["ocean_build.ocean_built"] = "4", ["stamina:exhaustion"] = "146.5", xp = "0", ["hud_manager:spawnit:hud_enabled"] = "y", died = "185", ["sethome:home"] = "(2218.833984375,40.9880027771,981.63397216797)", digged_nodes = "78520", placed_nodes = "127356", ["3d_armor_inventory"] = "return {\"\", \"\", \"\", \"\", \"\", \"\"}", ["ethereal:fly_timer"] = "-99" } } ``` Log identifier ``` [MOD] yl_report log identifier = 78z1iTu6uzJmvYWEgGXk3GNmRWwtT1xU ``` Profiler save: ``` profile-20241029T030404.json_prettyEE ``` Status: ``` # Server: version: 5.8.0-yl-debug | game: Minetest Game | uptime: 8d 19h 42min 5s | max lag: 2.56s | clients (16/52): Administrator, AliasAlreadyTaken, Bailiff, BebopJunkie, Crafter_Maniac, DanteLives, daydream, DragonWrangler1, flux, gianlp, Keya, nakama-ta, Service, tagtraum, toddie, ZiViZ ``` Teleport command: ``` /teleport xyz 2838 14 1010 ``` Compass command: ``` /give_compass Construction 78z1iTu6uzJmvYWEgGXk3GNmRWwtT1xU D2691E 2838 14 1010 ```

AliasAlreadyTaken was assigned by yourland-report

2024-10-29 04:04:04 +01:00

AliasAlreadyTaken added the

1. kind/bug

label 2024-10-29 04:14:26 +01:00

Sokomine was assigned by AliasAlreadyTaken

2024-10-29 04:14:35 +01:00

AliasAlreadyTaken removed their assignment 2024-10-29 04:14:39 +01:00

Sokomine commented

2024-12-05 23:31:31 +01:00

That is an essential function to create quest items. Those have to be distinguishable somehow from "normal" items.

Quest items can have a special id attached that is not visible to other players (only to the one who set it for his/her quest).

The texts could be logged and checked sometimes. But to remove this entirely would remove the option to create things - and in particular quests. Not only staff shall be able to create quests!

That is an essential function to create quest items. Those have to be distinguishable somehow from "normal" items. Quest items can have a special id attached that is not visible to other players (only to the one who set it for his/her quest). The texts could be logged and checked sometimes. But to remove this entirely would remove the option to create things - and in particular quests. Not only staff shall be able to create quests!

whosit referenced this issue

2024-12-10 18:14:05 +01:00

NPC can corrupt item tags - no item set- #7831

whosit commented

2024-12-10 18:20:07 +01:00

I think this is not a bug, but a feature. You can't use this to change any arbitrary meta, it allows you to change only description field of meta, which is normally used only to describe the item for the user - like on mouse over, etc. (and I guess, some other yl npc specific field? what is it?)

I think of it as attaching a little paper tag on a string to the item, to differentiate it from other items in some way - it's mostly harmless. If you need some way to verify item's authenticity - use other meta fields. Or maybe we should leave default description alone, but allow to add additional descriptions? But there's not enoguh tools in the engine for making additional fields visible to people...

I think this is not a bug, but a feature. You can't use this to change any arbitrary meta, it allows you to change only `description` field of meta, which is normally used only to describe the item for the user - like on mouse over, etc. (and I guess, some other yl npc specific field? what is it?) I think of it as attaching a little paper tag on a string to the item, to differentiate it from other items in some way - it's mostly harmless. If you need some way to verify item's authenticity - use other meta fields. Or maybe we should leave default description alone, but allow to add additional descriptions? But there's not enoguh tools in the engine for making additional fields visible to people...

AliasAlreadyTaken commented

2024-12-17 20:17:06 +01:00

If it's only the description, then it's not that bad.

I just don't want items have unexpected states and also I don't want players able to overwrite each other's description. They could mimic questitems of any quest, not only their own, thus invalidating other quest's items. If we want to keep this function, then

The change-able fields must be limited to the description
The item must not be stackable with other, normal items
The item must make it clear who (playeraccount) handed out the questitem Like "AliasAlreadyTaken's very terrible wine"
Questitems must not be changeable once they are set

Any other ideas how to limit this in a reasonable, but still useable way?

If it is meant to be quest items, then they also need to be read-able. Namespaced IDs? Hidden values?

Still I think it's dangerous and might confuse new players when someone offers them a "Instantly become staff medal" or similar.

If it's only the description, then it's not that bad. I just don't want items have unexpected states and also I don't want players able to overwrite each other's description. They could mimic questitems of any quest, not only their own, thus invalidating other quest's items. If we want to keep this function, then 1. The change-able fields must be limited to the description 2. The item must not be stackable with other, normal items 3. The item must make it clear who (playeraccount) handed out the questitem Like "AliasAlreadyTaken's very terrible wine" 4. Questitems must not be changeable once they are set Any other ideas how to limit this in a reasonable, but still useable way? If it is meant to be quest items, then they also need to be read-able. Namespaced IDs? Hidden values? Still I think it's dangerous and might confuse new players when someone offers them a "Instantly become staff medal" or similar.

Sokomine commented

2024-12-18 01:20:14 +01:00

AliasAlreadyTaken wrote:

They could mimic questitems of any quest, not only their own, thus invalidating other quest's items.

That's why there's an extra request in the text shown when creating such an item that the player ought to set a special ID so that that doesn't happen.

If a special ID is provided, then the item gets the additional metadata yl_speak_up:quest_item_for, yl_speak_up:quest_item_from and yl_speak_up:quest_id. That way it's possible to check if that quest item had been handed to that player and not just been dropped by another player.

Players can set the description of the item (that appears on mouseover) and the metadata string yl_speak_up:quest_id.

The modified items stack with each other but not with items with unmodified/other descriptions.

If a modified item is a block, placed and dug, it will turn back into a normal block.

The item must make it clear who (playeraccount) handed out the questitem Like "AliasAlreadyTaken's very terrible wine"

That's not possible as it would break immersion. Some may see NPC as enslaved by their owner, but - if an NPC hands something out and that item is named "AliasAlreadyTakens' letter to Tim Trader" but is in fact a letter NPC Amanda has written and given to the player for deliverance - no!

Questitems must not be changeable once they are set

To the contrary. NPC have limited inventory space. Once they get a quest item back, they delete all the special data and stack it back as a normal item into their inventory. Also placing and digging the item deletes the special data and description.

One thing I havn't thought of but may need to check is luacontrollers/digilines. They can read out item metadata. If they read out the special ID, a quest item may still be faked. NPC store which NPC handed out the quest item - but checking for that would be too much in most cases (might not even work if there's more than one NPC who hands out the item) and would rather confuse players.

AliasAlreadyTaken wrote: > They could mimic questitems of any quest, not only their own, thus invalidating other quest's items. That's why there's an extra request in the text shown when creating such an item that the player ought to set a special ID so that that doesn't happen. If a special ID is provided, then the item gets the additional metadata yl_speak_up:quest_item_for, yl_speak_up:quest_item_from and yl_speak_up:quest_id. That way it's possible to check if that quest item had been handed to that player and not just been dropped by another player. Players can set the description of the item (that appears on mouseover) and the metadata string yl_speak_up:quest_id. The modified items stack with each other but not with items with unmodified/other descriptions. If a modified item is a block, placed and dug, it will turn back into a normal block. > The item must make it clear who (playeraccount) handed out the questitem Like "AliasAlreadyTaken's very terrible wine" That's not possible as it would break immersion. Some may see NPC as enslaved by their owner, but - if an NPC hands something out and that item is named "AliasAlreadyTakens' letter to Tim Trader" but is in fact a letter NPC *Amanda* has written and given to the player for deliverance - no! > Questitems must not be changeable once they are set To the contrary. NPC have limited inventory space. Once they get a quest item back, they delete all the special data and stack it back as a normal item into their inventory. Also placing and digging the item deletes the special data and description. One thing I havn't thought of but may need to check is luacontrollers/digilines. They can read out item metadata. If they read out the special ID, a quest item may still be faked. NPC store which NPC handed out the quest item - but checking for that would be too much in most cases (might not even work if there's more than one NPC who hands out the item) and would rather confuse players.

Sign in to join this conversation.