Telepad Data Corruption?

Question

Telepad Data Corruption?

Sir-Will opened this issue 8 years ago · 6 comments

Sir-Will commented 8 years ago

hey,
is it possible to manipulate the packets and teleport other players with enderio?
We had two players on the server who could teleport any player and one had the telepad and the other one Coordinate Selector in the inventory.

EnderIO-1.10.2-3.1.156

HenryLoenwind · Answer 1 · 2017-04-04T18:52:18.000Z

yes, to a certain extend. I don't think it's possible to tp other players using a nonexistent telepad, but I'd have to double check that.

Xfel · Answer 2 · 2017-04-04T22:12:07.000Z

As far as I see, the telepad must actually exist, and it also has to be powered. However, the actual teleport of a player can apparently be triggered by sending a crazypants.enderio.teleport.telepad.packet.PacketTeleport to the server from any client, and here we can specify any player to be teleported, and it's not checked that the player is actually standing on the telepad.

Slind14 · Answer 3 · 2017-04-04T22:27:04.000Z

or is privileged to teleport others

tterrag1098 · Answer 4 · 2017-04-04T23:15:49.000Z

But that comes *from the server* so how could a client interfere?

…

On Apr 4, 2017 6:27 PM, "Slind14" ***@***.***> wrote: or is privileged to teleport others — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#4128 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ADk-8Os8_XjkLlr0WOlsAqT0Fum7jFPFks5rssO4gaJpZM4MzBzz> .

tterrag1098 · Answer 5 · 2017-04-04T19:56:29.000Z

All the teleport code is processed entirely on the server. I don't see any way the client could sent invalid data and have it executed.

HenryLoenwind · Answer 6 · 2017-04-05T08:24:10.000Z

@tterrag1098 The same packet is used for the GUI button, have a look at the call stack to its constructor...

PS: Edited the title to make it a bit less obvious.

Share to