search

BeeStation / BeeStation-Hornet

99.95% station. 0.05% bees
https://beestation13.com
GNU Affero General Public License v3.0
200 stars 682 forks source link

Remove show VV to player #11845

Open PowerfulBacon opened 2 weeks ago

PowerfulBacon commented 2 weeks ago

This is just a stupid option and can reveal sensitive information if a datum is accidentally shown to a player. Exposing admin tools produces huge security risks too.

Tsar-Salat commented 2 weeks ago

Was linking datums in asay ever added? I had a PR for it once, but I forget.

I think that would deprecate any remaining uses for this.

EvilDragonfiend commented 2 weeks ago

It can't be accidently shown, and players can't edit it. only viewing it. I feel this works as is enough? Contributors with no code perm might need to know what's going on for their TM'ed PR, and that serves the purpose well.

there might be some types that shouldn't be shown to players. would it be enough to put some protections onto such? like, we'd not want to "show vv to player" of /client or /admin_holder, smh.

PowerfulBacon commented 2 weeks ago

I don't see a reason to be ever showing this, even for non admin contributors. I don't trust admins not to accidentally reveal sensitive info and this whole think is a giant security risk.