Export strings may contain attempt data that should probably be discarded
rdw-software opened this issue ยท 0 comments
There's CleanItemForImport
to strip some information before importing Custom items. But I don't see an equivalent for exporting. Currently, export strings seem to always include the exporting user's attempts data (times, counts, dates).
Aside from increasing the size of the exported table, and with it the length of the export string, this doesn't seem desirable from a "security" perspective (not too important for a WOW addon, but still...)? I doubt someone wants to import the actual attempts, nor to export them in the first place. It may not be obvious that the export string could even contain this data.
If there isn't a mechanism to strip attempts, it should either be done by default or with an optional checkbox.
(Obviously any changes will have to be backwards-compatible, but Rarity could silently drop attempts on import/export)
Example:
{
build = 690,
items = { {
attempts = 484,
chance = 968,
dates = {
[20190803] = {
attempts = 385,
time = 7354.464
},
[20190804] = {
attempts = 99,
time = 882.58499999996
}
},
export = true,
itemId = 170188,
method = "NPC",
name = "Barnacled Bag of Goods",
npcs = { 152413, 153263, 152416, 152411, 152414, 148391, 145346, 148392, 152412 },
session = {
attempts = 41,
time = 400.99699999997
},
time = 8237.049,
type = "ITEM"
} },
signature = "RFI2PD4jOjJ0NntgInc/ZA=="
}
Does it really matter if people can see the attempts, date, and times? Probably not. But there's no reason to include this data, especially if players didn't deliberately choose to export it. IMHO, SavedVariables data should be excluded.
Potentially, this might also skew statistics and affect the displayed session times (unless fully removed)?