Missing permission checks for Maniaplanet

[Chris92de]

See title

[Chris92de]

Reproduction steps

[CodyNinja1]

same thing happens with maniaexchange plugin

[CodyNinja1]

Some new things that I discovered that might be related to this:

Bug Number 1:

1. Go into current channel, then leave
2. Open the "create a new map" window
3. As quick as possible, click on the channel, then click "create new map" (this may require high latency)
4. The game should open the editor then join the channel
5. Leave server, classic menu should open as shown in this image: https://media.discordapp.net/attachments/1069614778793873459/1078177296017522719/image.png?width=713&height=401

Bug Number 2 (may not be related to openplanet): If you have openplanet and you downloaded the TM2 Stadium titlepack, you can open it in offline mode. Although this can sometimes work without openplanet.

Bug Number 3: Using the Nod Explorer in Developer Mode, you can gain access to account customization (horn, crosshair, profile picture, and nickname). However, using them may crash the game after a while (as it should :P).

[CodyNinja1]

This also occurs not only in demo mode, but for any titlepack you don't own.

[CodyNinja1]

I would like to confirm that this also happens in the Trackmania Turbo Demo for PC. However, you can check for bool demo = cast<CGameManiaPlanet>(GetApp()).ManiaPlanetScriptAPI.TmTurbo_IsDemo; to see if the current player is using a demo version on Trackmania Turbo.

[CodyNinja1]

I made this piece of code in AngelScript to see if it's possible to find out if the current loaded ManiaPlanet Title is a demo or not. This checks the user's stations and sees if the loaded ManiaPlanet Title matches with one of the stations, if it doesn't find it, it assumes the loaded ManiaPlanet Title is a demo.

enum EDemo {
    Demo,
    NotDemo,
    Unknown
}

EDemo isLoadedManiaTitleDemo()
{
    auto app = cast<CGameManiaPlanet>(GetApp());
    if (app.CurrentProfile is null) { print("Player is not logged in."); return EDemo::Unknown; }
    try {
      for (int i = 0; i < app.Stations.Length; i++)
      {
          @app = cast<CGameManiaPlanet>(GetApp());
          auto stations = app.Stations;
          auto stationTitle = stations[i].Title;
          if (stationTitle is null) { continue; }
          auto stationID = stationTitle.TitleId;
          auto loadedID = app.LoadedManiaTitle.TitleId;
          if (stationID == loadedID)
          {
              return EDemo::NotDemo;
          }
      }
      return EDemo::Demo;
    }
    catch {
        return EDemo::Unknown;
    }
}

This can be used in the Create Map plugin to see if the user owns the loaded ManiaPlanet Title, if they don't, the plugin won't allow the user to create the map.

Here you can see an example of the code in action: https://streamable.com/jcgjj6

[CodyNinja1]

I have made modified versions of the "Create New Map" plugin in Trackmania Turbo and Maniaplanet to showcase the Permissions.

Maniaplanet: https://streamable.com/ax9782 Trackmania Turbo: https://streamable.com/26ngru

Now I hope that maybe someone from the Openplanet team will add it to the Permissions Plugin! 🙏🏽