search

FallingColors / HexMod

Minecraft mod about drawing spells
MIT License
122 stars 87 forks source link

Create Deployers can trigger Toolsmith Impeti with its owner as the caster #665

Open yezhiyi9670 opened 5 months ago

yezhiyi9670 commented 5 months ago

Modloader

Forge

Minecraft version

1.20.1

Hex Casting version

0.11.1-7-efc8899

Modloader version

47.2.30

Modpack info

No response

The latest.log file

No response

Issue description

Create Deployers can trigger Toolsmith Impeti with its owner (the one who placed it) as the caster. This allows affecting a player remotely without her permission or even instantly killing her (see #663) if a bad guy manages to steal her deployer. This is much easier than True Name stealing and has worse consequences.

Just note that Deployers can be easily moved using Minecart Assemblers.

Steps to reproduce

Screenshot

  1. Have two players (Alice and Bob) join the same world.
  2. Make a spell circle containing Mind's Reflection and Reveal.
  3. Bob: Place a deployer facing the impetus.
  4. Alice: Make the deployer work, possibly by using a hand crank. ❎ Note that the spell will reveal Bob instead of Null.

A spell circle as described in #663 can kill Bob regardless the distance.

Other information

Curiously, deployers holding casting items will not cast the Hex with its owner as the caster. Running Mind's Reflection and Compass Purification will result in the deployer's position in this case.

walksanatora commented 5 months ago

this is due to how create deployers make a fake-player of the player who placed them. there is (probably) a way we could add a config to disable fakeplayer starting circles.