ParadiseSS13 / Paradise

Paradise Station's GitHub main repository.
https://www.paradisestation.org/forum
GNU Affero General Public License v3.0
401 stars 1.2k forks source link

Opening a uplink(possibly for the first time) from another job&species grants the job/species items despite the uplink belonging to another person entirely #27027

Open 1080pCat opened 5 days ago

1080pCat commented 5 days ago

Exploit Reports

BYOND Version

515.1643

Issue Description

When you open a uplink(likely for the first time) it grants the species/job specific items that pertain to the opener, despite the PDA/uplink belonging to another job, and specie

What did you expect to happen?

To get another jobs uplink items

What happened instead?

got stuff for my job/species

Why is this bad/What are the consequences?

If you somehow get the password for a unopened uplink, as.. lets say, a cling, you probably shouldn't be able to then get the benefits from your species unique items? For example, a vox cling with a spike thrower from a vulp chaplains uplink

Steps to reproduce the issue.

  1. manage to get the password for someones unopened uplink
  2. open the uplink as a different job&species to the person you got the uplink from
  3. see that the species/job dependent items are related to your stuff, not the owners

When did the problem start happening?

forever probably

Extra information

My guess is its generating the stuff on open rather than spawn

Relevant log output/runtime error

No response

TravisAngeI commented 5 days ago

I wonder how FRAME cartridges interact with this bug?