search

fchat-pidgin / fchat-pidgin

A pidgin/libpurple plugin for the F-List roleplaying webchat
GNU General Public License v2.0
23 stars 10 forks source link

Dice roll / bottle spin results easily faked #89

Open syldrathecat opened 8 years ago

syldrathecat commented 8 years ago

The visual result of /roll and /bottle are easily faked in appearance to pidgin users by using BBCode such as [url=http://f-list.net/c/syldra%20kitty]Syldra Kitty[/url] rolls 1d6: [b]6[/b]. The messages appear identical and the only way to tell them apart would be to watch the debug log.

Screenshots each show one real message, and one faked one:

2016-01-03_21-29-01-snip 2016-01-03_21-30-47-snip

vobe commented 8 years ago

See #67 and the associated commit for an explanation. I couldn't find a better way to solve it using only libpurple. However, maybe a pidgin-only solution could be found with some gtk trickery.

syldrathecat commented 8 years ago

That's super helpful, I'm not sure I would've noticed that.

I saw a potential way for gender icons to be inserted before the username. In theory there could be special icons for dice rolls and bottle spins in the same way, but it rates pretty high on the Pidgin hackiness scale.

An exclusive smiley inserted in to the message itself that can't be activated in any other way could've worked, but nothing stops someone creating an identical looking eicon now.

There's still the opportunity to use some kind of formatting unavailable through bbcode though, like an exclusive colour (like the red background on /warn). Looking at the gtkconv code though, it seems like the tab will light up correctly if a PURPLE_MESSAGE_RAW type message is used, which could work in place of a system message.