battlecode / battlehack20

🐍
https://bh2020.battlecode.org
GNU General Public License v3.0
12 stars 3 forks source link

Scrimmage servers should ONLY be able to report the result of a scrimmage #122

Open arvid220u opened 4 years ago

arvid220u commented 4 years ago

If one has access to the scrimmage server, one should not be able to do anything else.

As it is right now, one gets access to the database admin account and can do pretty much whatever one wants. We probably want to make a scrimmage_updater account with fewer privileges to prevent this.