Author Topic: put <currency> on <surface> bug  (Read 2026 times)

Offline z993126

  • BFF
  • ***
  • Posts: 128
    • View Profile
put <currency> on <surface> bug
« on: February 23, 2012, 05:40:42 AM »
Cannot put currency on or in containers not in your inventory.  Requires additional checks in can_put_wrd_wrd_word_obj() and do_put_wrd_wrd_word_obj() in /verbs/items/put.c...

Offline z993126

  • BFF
  • ***
  • Posts: 128
    • View Profile
Re: put <currency> on <surface> bug
« Reply #1 on: February 23, 2012, 06:11:22 AM »
Further investigation yields the following interesting facts:
Case 1:  "put die on table"
CanPut() gets called with arguments /secure/save/creators/a/ardneh, /lib/die#2606

Case 2:  "put 10 silver on table"
CanPut() gets called with arguments /secure/save/creators/a/ardneh, /realms/ardneh/area/obj/table#2593

In case 1, the object being put is the argument, which satisfies the
Code: [Select]
  if( what ){ env = environment( what ); }
  if( !env || env != this_player() ){ return "#You don't have that."; }
bit in /lib/events/put.c, whereas case 2 the argument is where you're trying to put an object that doesn't even exist yet.

So...the currency pile object needs to be made in can_put_wrd_wrd_word_obj() to be passed to CanPut(), I think?

Offline z993126

  • BFF
  • ***
  • Posts: 128
    • View Profile
Re: put <currency> on <surface> bug
« Reply #2 on: February 23, 2012, 07:15:28 AM »
...except if you pick up the table you can put the silver on it all you want.  So that...isn't the problem, exactly.

Also there's some code in /verbs/items/put.c that's something like
Code: [Select]
get_object(num + " " + curr);when that syntax is bogus; I can clone two of an object, get_object("thing"); returns that object, but get_object("2 things") and get_object("2 thing") both return 0.  So that's something else in the sequence that isn't helping things.

Offline z993126

  • BFF
  • ***
  • Posts: 128
    • View Profile
Re: put <currency> on <surface> bug
« Reply #3 on: February 25, 2012, 07:40:26 AM »
Further strangeness going on with 'put':



You cannot put 2 chunks of tin/whatevers (that's in a plural form) on the table UNLESS it already has some of that on it, in which case you can?  (But 'put 2 chunk of tin' works.)

This is seriously bizarre.  Any idea what's really going on here?  (Oh, I checked to see what would happen if you forced can_put_obj_obj() to make the argument singular before passing it on to can_put_obj_word_obj():  turns out, absolutely nothing.)

Offline z993126

  • BFF
  • ***
  • Posts: 128
    • View Profile
Re: put <currency> on <surface> bug
« Reply #4 on: February 26, 2012, 07:19:46 AM »
Fix for the not being able to put multiple objects on an item not in your inventory:
/lib/events/put.c, in CanPut() changed
Code: [Select]
if(!env || env != this_player()){
  return "#You don't have that.";
}

to

Code: [Select]
if(!env){
  return sprintf("The %s doesn't have an environment.  Please file a bugreport.", remove_article(GetShort()) );
}

can't really think of any specific cases where you'd want to prevent putting at the CanPut() stage when the container is in the player's environment instead of their inventory.

Offline quixadhal

  • BFF
  • ***
  • Posts: 618
    • View Profile
    • A Waste of Time
Re: put <currency> on <surface> bug
« Reply #5 on: February 26, 2012, 07:50:22 PM »
can't really think of any specific cases where you'd want to prevent putting at the CanPut() stage when the container is in the player's environment instead of their inventory.

So, since you removed the check which is probably part of the common sense security system, now you can put things from OTHER player's inventories into your own, without them knowing?

Hope you did a code audit to ensure that is being checked for somewhere further down the call chain.

Offline z993126

  • BFF
  • ***
  • Posts: 128
    • View Profile
Re: put <currency> on <surface> bug
« Reply #6 on: February 26, 2012, 10:54:23 PM »
...what?

No, the check was for the *target* container.  The object being put still needs to be in your own inventory.

Offline quixadhal

  • BFF
  • ***
  • Posts: 618
    • View Profile
    • A Waste of Time
Re: put <currency> on <surface> bug
« Reply #7 on: February 28, 2012, 07:19:11 AM »
So you're claiming it was a redundant check, which was already performed higher up in code you didn't quote?

I'm not saying you're right or wrong, but I find people often don't think about security when making what seem like trivial changes to "optimize" things.  So, hopefully, "made you look!"