
Telepad Data Corruption?
Sir-Will opened this issue · 6 comments
hey,
is it possible to manipulate the packets and teleport other players with enderio?
We had two players on the server who could teleport any player and one had the telepad and the other one Coordinate Selector in the inventory.
EnderIO-1.10.2-3.1.156
yes, to a certain extend. I don't think it's possible to tp other players using a nonexistent telepad, but I'd have to double check that.
As far as I see, the telepad must actually exist, and it also has to be powered. However, the actual teleport of a player can apparently be triggered by sending a crazypants.enderio.teleport.telepad.packet.PacketTeleport
to the server from any client, and here we can specify any player to be teleported, and it's not checked that the player is actually standing on the telepad.
All the teleport code is processed entirely on the server. I don't see any way the client could sent invalid data and have it executed.
@tterrag1098 The same packet is used for the GUI button, have a look at the call stack to its constructor...
PS: Edited the title to make it a bit less obvious.