ABCxFF / diepcustom

An open source diep.io custom private-server template
https://diepcustom.herokuapp.com/
GNU Affero General Public License v3.0
69 stars 60 forks source link

Some commands can bypass permissions #107

Closed nodenotjs closed 1 year ago

nodenotjs commented 1 year ago

What is inconsistent Commands like game_set_level, game_set_tank and game_claim can bypass the BetaAccess permission. They allow you to go beyond level 45, set to a developer tank and possess an entity

Also, game_set_stat & game_set_stat_max currently does not limit values for BetaAccess, which allows overpowered tanks (like immortal, insta kill, insta reload and flash speed). game_teleport it's also very powerful for BetaAccess

Expected behavior game_set_level should cap at level 45 for not FullAcces players game_set_tank check and disallow for unauthorized tanks game_set_stat must cap values for BetaAccess (including disallowing values less than 0) for the maximum status value game_claim, game_set_stat_max and game_teleport raise the permission level to FullAccess

nodenotjs commented 1 year ago

Closed due to pull request