depwl9992 / anomalyjobs

Automatically exported from code.google.com/p/anomalyjobs
0 stars 0 forks source link

TRIG_CLEAN needs to remove non-bucket dbrefs from JOBSB #131

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
What steps will reproduce the problem?
1. Toggle player access to a bucket to set JOBSB
2. Nuke the bucket (other than by using +bucket/delete)

What is the expected output?
Bucket dbref removed from JOBSB

What do you see instead?
Invalid dbref is in JOBSB. In theory if a new bucket was created that recycled 
the dbref, a player could end up with access to a bucket that they shouldn't 
have.

Please use labels and text to provide additional information.
Minor/rare issue but shouldn't be too hard to check for bucket-ness in JOBSB 
attribute during TRIG_CLEAN.

Original issue reported on code.google.com by widdis@gmail.com on 10 Nov 2010 at 8:58

GoogleCodeExporter commented 9 years ago
Might also want/need to do this for a JOBSJ attribute for single-job access if 
that ends up being part of Issue 128 solution.

Original comment by widdis@gmail.com on 10 Nov 2010 at 10:57

GoogleCodeExporter commented 9 years ago
Adapted JOBSB to use OBJIDs in all codebases except TM3, which lacks a creation 
time attribute.  This resolves the security issue of a re-used dbref.  An old 
dbref/ctime combination may hang around in JOBSB but it is harmless.

Original comment by widdis@gmail.com on 13 Dec 2010 at 4:05