Ender IO Zoo

Ender IO Zoo

962k Downloads

Server doesn't check clients config

AfterRebelion opened this issue ยท 6 comments

commented

Issue Description:

You can change configs clientside, and the server doesn't notice.

What happens:

When you change a config clientside (I only tested for now on the DarkSteel section, as it is the easiest), that settings don't get checked, and will run without problems. For example, you can change speed and jump boosts, or energy consumption, and they will apply without problem.

What you expected to happen:

That when a user on a server changed his configs files, the server notices it, and kicked that player. Or that it ignored the changes made.

Steps to reproduce:

  1. Go to EnderIO config ingame on a server, and DarkSteel
  2. Change darkSteelBoostJumpModifier to 10
  3. Equip DarkSteel Boots with Jump III modifier, and FLY!
    (For what I tested, it also works if you first change the settings, and then you join the server)
    ...

Affected Versions (Do not use "latest"):

  • EnderIO: 3.1.179
  • EnderCore: 0.4.1.65
  • Minecraft: 1.10.2
  • Forge: 12.18.3.2254

Your most recent log file where the issue was present:

https://gist.github.com/AfterRebelion/d1c7af5a699cf3b209d2de92c8b3bb99

commented

not good. progressive automation has same issue.

commented

That's a Minecraft problem. Player movement is computed client-side, the server only does rough plausibility checks ("player moved too fast", "flying is disabled on this server").

Nothing we could do here, short of remaking the base game.

commented

i didnt know this. thanks

commented

@HenryLoenwind but as I said, it is not only on movement, that was only a simple example. It happens with almost all settings on that section. For example we later tried 2 other things -Increasing the efficency effect on obsidian of the darksteel pickaxe, and reducing the RF cost of the armor, and it worked.

commented

@HenryLoenwind Could you sync the server configs to the client on connection? That would solve this issue.

commented

or maybe check them against for the important parts to at least prevent abuse