Level 255 bug

[Merth]

Some people on my server found themselves to be level 255, even though #level is built to prevent > 65 as an argument. The bug happens when a lower priveleged user targets an NPC and types #level 255.

The bug is in client.cpp, and here's the fix if you want it. (Note, I decided to make it so server ops can set level > 65 on a target)


bool Client::PrivUser(const Seperator* sep){
...
if ((strcasecmp(sep->arg[0], "#level") == 0)) {
int16 level = atoi(sep->arg[1]);
if ((level <= 0) || ((level > 65) && (this->admin < 100)) ) {
Message(0, "Error: #Level: Invalid Level");
}
else if (admin < 100) {
this->SetLevel(level, true);
}
else if (!target) {
Message(0, "Error: #Level: No target");
}
else {
if (!target->IsNPC() && ((this->admin < 200) && (level > 65))) {
Message(0, "Error: #Level: Invalid Level");
}
else
{
target->SetLevel(level, true);
}
}

...

[Zern]

Hmm with the code you posted any GM/Statused people specifically those with or over 100 status or those with or over 200 for the if(!target->IsNPC() && ((this->admin < 200) && (level>65))) command wont be able to set the levels of PC/NPCS.


o.O


Might want to reverse that " < " sign to " > " :0)~

[Merth]

The code posted above does:

* Users (< 100 status) can only set levels on themselves
* Users (< 100 status) can only set their level to 0 < level < 66
* GM's (< 200 status) can set level on any PC to 0 < level < 66
* GM's (< 200 status) can set level to be anything in range on an NPC
* Server Ops can set any level on any target

[Zern]

OK I see what your intentions are, forgive me as I have this legit server mentality going on and seen it as a flaw :)

[gej302]

Is admin different from this->admin?

you use both in that snippet, I figure it would be better to use one or the other for consistency if not for bug prevention. I would recommend:
else if (this->admin < 100) {
this->SetLevel(level, true);

[kathgar]

admin are this->admin are always the same, unless you do something very wrong.

this is a pointer to current object(in this case the Client class that sent the message)

since their isn't a local variable named admin in the function, it goes to the class to look and there is a variable, boom uses it

this->admin basically does the same thing, but would work if someone made a local varible admin

[gej302]

I know in this case they end up equivalent, but I feel safer without assuming the compiler knows what I'm thinking, especially in multi-dev projects ;)