oscar-broman / samp-weapon-config

A more consistent and responsive damage system with many new features
Apache License 2.0
91 stars 84 forks source link

Fix for fire & explosion -related damage spoofing #214

Closed NexiusTailer closed 3 years ago

NexiusTailer commented 3 years ago

Full description of the problem:

  1. All weapons that a player sends with valid issuerid in OnPlayerTakeDamage successfully being checked according to 's_ValidDamageTaken', if such damage reason cannot be valid in both Give/Take damage events, the script rejects it;
  2. If the weaponid passed the first check (it is valid reason for both modes), we have additional checks after that, manually checking all the conditions and find if something can be wrong with each damage reason;
  3. After those checks has passed, we still didn't check WEAPON_FLAMETHROWER and WEAPON_EXPLOSION reasons (whether the damage is reported by a player who has not even logged in? / on the other end of the map from the issuer? / other impossible conditions that we do not check at all?).

The cause of the fact I've ignored this damage reasons before and didn't add any validation for it in the previous PRs is that these reasons can be called by a victim long time after issuerid become dead (pretty easy to imagine when a player set fire to another and died himself, and the second continues to burn as long as possible). So, preventing such damage if there is a long dist between two players or if issuerid is not spawned and a long time has passed after his death means the damage would stop after your issuerid become dead or anything, even if you burn or see an grenade explosion just in front on the skin.

But the case still need to be restricted and validated anyhow, so I've decided to reset issuerid in case of failure of validation checks, like it has done in OnPlayerDeath. I think this is a good compromise to prevent the last possible bypasses from the victim's side that can cause fakekills or anything similar.