Go Back   EQEmulator Home > EQEmulator Forums > Support > Support::General Support

Support::General Support Post all topics here having to do with errors while trying to connect to an EQEMu server but not about the setup/running of the Server itself.

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #4  
Old 09-18-2007, 07:04 AM
sfisque
Hill Giant
 
Join Date: Oct 2006
Posts: 248
Default

conceptual security risk:

server A uses min_status to control access to flagged zones.

zone azone01 requires min_status = 15.

player01 does the flagging quest, and has their status bumped from 0 to 15. player01 then, tries doing the quest again, to see what happens (lets face it, players are curious by nature). upon completing the quest, their status gets elevated from 15 to 30 (the quest writer forgot to test whether they already had the status set appropriately). now the player has status 30. they repeat this endeaveor a few more times, eventually gaining a status of 255+ which gives them GM status. they then run rampant through the server overwriting mob entries in the database, etc.

moral of the story: variables should not serve multiple exclusive purposes, except in specific context (careful bit masking, tight memory conditions, etc.)

why you see alot of zones set to status = 100. the PEQ crew generally keep zones set to 100 when they are not complete. case in point, PoNightmare is set to 100. it has mobs, spawns, loot, etc. but the factions are not complete, and most of the mobs are incorrectly indifferent. when was the last time you walked through PoN (on Live) fully visible and shook hands with a Scourge Hobgoblin who con'ed indifferent?

== sfisque
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

   

All times are GMT -4. The time now is 02:53 AM.


 

Everquest is a registered trademark of Daybreak Game Company LLC.
EQEmulator is not associated or affiliated in any way with Daybreak Game Company LLC.
Except where otherwise noted, this site is licensed under a Creative Commons License.
       
Powered by vBulletin®, Copyright ©2000 - 2025, Jelsoft Enterprises Ltd.
Template by Bluepearl Design and vBulletin Templates - Ver3.3