FusionWowCMS / FusionCMS

FusionCMS is a free, open-source content management system. Server owners all around the world rely upon FusionCMS for its ease of use and development, safe and secure codebase and dedication to simplicity.
Other
69 stars 42 forks source link

[Security] Don't show GMs in online list #21

Closed crowbait closed 11 months ago

crowbait commented 11 months ago

In the "players online" module, GMs are shown along with everyone else, even when they are invisible. This can easily become a problem when trying to investigate suspect behavior, as the player doing something illicit can just check the online list and possibly see known GM chars online so they just stop whatever they're doing until the GM leaves again. Although not in the traditional sense, this might be considered a security issue, since it hinders the ability to police activity on the server.

GM chars should not be shown in the "players online" list when invisible, although not showing GM chars at all is most likely easier and fits the bill quite as well.

The "players online" module may be disabled, but that's a workaround throwing away quite cool functionality.

I've tried resolving the problem myself, but the complexity of this project greatly surpasses my abilities with PHP.

crowbait commented 11 months ago

Nicely done, thank you