Spawning Public Folders & Streamer Camera pictures bypass No Spawn Permissions

[AshtonSparx]

Describe the bug

When you're a spectator, you can spawn public folders using the Envelop Button in your inventory & Streamer Cameras screenshot function also bypass No Spawn permission.

Relevant issues

None That I could Find

To Reproduce

1. Be put as spectator
2. Click on the envelop on a public folder, it should spawn
3. Open your stream camera, click on the Settings Cog, enable Spawn photo in the world
4. Take a picture

Expected behavior

When you don't have spawning permissions, none of these should spawn the item in the world

Bug information (please complete the following information):

• How often does it happen: Always
• Does the bug persist after restarting Neos? Yes
• Neos Version: 2021.7.6.1260
• Neos Platform: Any
• Link to reproduction World/Item: N/A
• Regression: This has always worked as far as I know

Reporters:

AshtonSparx#5050

[ProbablePrime]

I'm in this area due to #3134 so I'll take a look.

Thanks!

[ProbablePrime]

Can you verify: "Streamer Cameras screenshot function also bypass No Spawn permission"?

In: https://github.com/Neos-Metaverse/NeosPublic/issues/934 Froox made some tweaks here and looking at the code I see the appropriate restrictions in place.

It does still spawn the photo, but it uses a system called "Local Slots" which I admit is the first time I've seen this or heard of it so I'm not sure how it works. At a guess its probably a slot that only you can see that is not synchronized.

Its a bit late, so I'm heading off but give this a try in a world with another user and your setup. Can they see the photo that is spawned?

I've fixed the other one in the same set of changes as #3134 though, that's under review :)

[shiftyscales]

Yes, that code was recently changed in 2021.10.11.1175, @ProbablePrime:

Tweaks:

• When capturing photos (either with InteractiveCamera or gesture photo) in scenarios where they can't be (or are configured not to) spawned in the world, they're temporarily spawned locally and processed as usual -- E.g. if you have auto-saving configured, they will be automatically saved into your inventory, even if you're spectator with spawning disabled

I still unfortunately miss out on photos I'm in but don't take under these conditions, but hopefully Frooxius will be able to implement the 'phonge' sometime.

[AshtonSparx]

Can you verify: "Streamer Cameras screenshot function also bypass No Spawn permission"?

In: #934 Froox made some tweaks here and looking at the code I see the appropriate restrictions in place.

It does still spawn the photo, but it uses a system called "Local Slots" which I admit is the first time I've seen this or heard of it so I'm not sure how it works. At a guess its probably a slot that only you can see that is not synchronized.

Its a bit late, so I'm heading off but give this a try in a world with another user and your setup. Can they see the photo that is spawned?

I've fixed the other one in the same set of changes as #3134 though, that's under review :)

Just tried it and it's patched!

[ProbablePrime]

Ok Excellent thanks for the help Shifty and Ashton.

I have changes in review for the public folder spawning. So this should be solved soon.

[Frooxius]

Merged in 2021.10.17.1326, thanks everyone!