Cum descarc de pe TeraBox?

[[HF]White]

*Descriere:

Aceasta este rezolvarea pentru un exploit la functia lua "pc_change_name" prin care playerii pot abuza si sa faca dupe la obiecte.

Acest FIX rezolva acest lucru prin delogarea jucatorului dupa ce acestia isi schimba numele.

*Poze / Video:

*Link download / Code:
Deschidem questlua_pc.cpp si cautam:

Code:

 int pc_change_name(lua_State* L)

Mai jos vom gasi:

Code:

		db_clientdesc->DBPacketHeader(HEADER_GD_FLUSH_CACHE, 0, sizeof(DWORD));
		db_clientdesc->Packet(&pid, sizeof(DWORD));

Inlocuim cu:

Conținut: Ascuns

Motiv: Trebuie să reacționezi la mesaj pentru a vedea conținutul.

[Thorfinn]

Code:

	ALUA(pc_change_name)
	{
#ifdef ENABLE_LOCALECHECK_CHANGENAME
		lua_pushnumber(L, 5);
		return 1;
#endif

		LPCHARACTER ch = CQuestManager::instance().GetCurrentCharacterPtr();

		if ( ch->GetNewName().size() != 0 )
		{
			lua_pushnumber(L, 0);
			return 1;
		}

		if ( lua_isstring(L, 1) != true )
		{
			lua_pushnumber(L, 1);
			return 1;
		}

		const char * szName = lua_tostring(L, 1);

		if ( check_name(szName) == false )
		{
			lua_pushnumber(L, 2);
			return 1;
		}

		char szQuery[1024];
		snprintf(szQuery, sizeof(szQuery), "SELECT COUNT(*) FROM player%s WHERE name='%s'", get_table_postfix(), szName);

		auto pmsg(DBManager::instance().DirectQuery(szQuery));
		if ( pmsg->Get()->uiNumRows > 0 )
		{
			MYSQL_ROW row = mysql_fetch_row(pmsg->Get()->pSQLResult);

			int	count = 0;
			str_to_number(count, row[0]);

			if ( count != 0 )
			{
				lua_pushnumber(L, 3);
				return 1;
			}
		}

		DWORD pid = ch->GetPlayerID();

		// @fixme309 BEGIN
		ch->Save();
		ch->SetExchangeTime();
		ch->ChatPacket(CHAT_TYPE_INFO, LC_TEXT("The name has been successfully changed. You're going to get disconnected."));
		ch->GetDesc()->DelayedDisconnect(10);
		// @fixme309 END

		/* delete messenger list */
		MessengerManager::instance().RemoveAllList(ch->GetName());

		/* change_name_log */
		LogManager::instance().ChangeNameLog(pid, ch->GetName(), szName, ch->GetDesc()->GetHostName());

		snprintf(szQuery, sizeof(szQuery), "UPDATE player%s SET name='%s' WHERE id=%u", get_table_postfix(), szName, pid);
		auto msg = DBManager::instance().DirectQuery(szQuery);

		ch->SetNewName(szName);
		lua_pushnumber(L, 4);
		return 1;
	}