jpcsupplies / Economy_mod

Basic Economy System for Space Engineers
13 stars 12 forks source link

[reported bug] Players able to sell all items on grids including items in containers they have no access to? #174

Open jpcsupplies opened 6 years ago

jpcsupplies commented 6 years ago

I've asked if the containers in question are shared to said players.. waiting on answer at the moment.

The1TrueJaeger 11 hours ago Delete I have a concern about player trade stations. I am currently running one on a server, and I provide cryopods for baseless players to be able to log off overnight. It appears that the players - while in the cryopods - can sell items which are on containers on my base, even though the cryopods are on a completely separate conveyor system. The same applies to connectors. This basically means they can sell my items and gain money for it - essentially ripping me off. They could even go through the lengths as to build a cockpit on the base and start selling from there. any way to prevent the sales if the player does not have access / ownership over the containing container?

jpcsupplies commented 6 years ago

Ok just made a creative world. Pasted in a small grid ship and changed its ownership to another player. I now have no access to the cargo space. I then sat on a seat on this ship and purchased 10 computers. The computers went into the cargo container i have no access to. I then told economy to sell all computer and it sold those computers out of the cargo container I didn't own.

Has something changed here on owner checks or is this a bug we somehow overlooked all this time?

midspace commented 6 years ago

We aren't doing individual block ownership checks. I think we were relying on overall grid ownership checks to be sufficient, which does appear to be the case.

https://github.com/jpcsupplies/Economy_mod/blob/master/Economy/Data/Scripts/Economy.scripts/Messages/MessageSell.cs#L233

midspace commented 6 years ago

That should fix it. I'm going to crawl back into a warm dark hole now and nap for a while.

jpcsupplies commented 6 years ago

Ok i shall push this out . or you want to test it on Lawless Void first ?

jpcsupplies commented 6 years ago

ok its pushed out there..