OpenCollarTeam / OpenCollar

Other
121 stars 127 forks source link

Capture App allows things it shouldn't, and disallows things it shouldn't #489

Open marrmist opened 3 years ago

marrmist commented 3 years ago

What version of OpenCollar are you using? 8.0.4000

What behavior did you expect? Temporary captor should be able to do immediately useful things (like control force-sitting), but not things that subvert the collar's control indefinitely (like unlocking it)

What behavior did you see instead? Temporary captor is able to unlock the collar, but is not able to enable strict sitting to sit-lock captive. I didn't test access to other features but I could if needed.

What steps does someone need to take to reproduce the problem?

zontreck commented 3 years ago

There is code in there that attempts to disable things like the Access menu, lock, etc, but apparently that code needs to be rechecked. As for strict sitting, that toggle i believe is denied to trusted access, which is what the captor gets assigned. I can expand access to that checkbox, no problem.

zontreck commented 3 years ago

If you see anything else that should be revised for capture, please, respond to this ticket with further information, otherwise the only two things pending a fix is

1) Strict Sit 2) Lock/Unlock

marrmist commented 3 years ago

Thanks for the quick response. I'll poke through all the buttons and bring up any other items that I think should behave differently under capture.

One thing I would like to see return (if I'm not remembering wrong, some previous version of the capture app had it), is replacing the Access button on the main menu with the Capture button from the Apps menu. A captor has no use for the Access menu, and the Capture menu is a logical replacement, since they can use it to revoke their own access. I can put that in a separate feature request ticket if you'd like.

zontreck commented 3 years ago

The access button & it's functions are inaccessible. If the captor clicks it, it'll tell them that it's denied while captured. Also the chat commands are tied into that same logic.

No version has ever renamed the Access button though.

zontreck commented 3 years ago

Either way I will prioritize this issue for 8.0.5. Toggling lock shouldn't be possible. And i need an excuse to do a 8.0.5 anyway since SL reverted the addon script in the installer version.. So i can't release beta cuffs until that script is fixed for everyone.

marrmist commented 3 years ago

Settings > Addon... > WearerAdd and AddonLimited. I'm not clear on what WearerAddons means so I don't know if this one should be available. AddonLimited should definitely not be available to a captor, since it relates to the ability to modify the access list and weld.

The captor is not able to change RLV relay options. This one could be argued both ways, but my opinion is that the captor should be able, both to enable the RLV relay for use, or to disable the RLV relay if their captive is stuck in a trap via the collar's relay. RLV relays themselves serve to provide a form of temporary access that is, in my opinion, consistent with the temporary access afforded to a captor.

The captor is not able to initiate couples animations. (No authentication error is displayed, but no followup menu is given)

The captor is able to add/remove Bookmarks. Adding is dubious. Removing definitely doesn't seem like it should be allowed.

Also just so you know, while the captor is able to Unlock, the captor is not able to Lock it again. Which is fine, but maybe that detail helps you find the issue.

zontreck commented 3 years ago

WearerAddons means can the wearer use addons they own

So yes that menu needs to be blocked entirely.

zontreck commented 3 years ago

We'll have a menu toggle to block / allow in relay for capture i think. Couples animations, well, that needs to be fixed then.

Bookmarks, should probably be blocked - the script itself is very messy and needs a rewrite, i just didnt feel like doing it for v8 And yes that detail about lock will help me identify the area of code lacking the block.

SilkieSabra commented 1 year ago

Has this issue been corrected in the latest version of oc_capture?

Medea-Destiny commented 1 year ago

Capture grants temporary trusted auth level. This isn't an issue with the capture script, it's more about what other scripts allow at trusted auth level. Not sure how many of these items have been addressed, though I'm pretty sure trusted can't unlock collars any more!