map settings are always run with access level Owner

Bug #307753 reported by Yann Kaiser
254
Affects Status Importance Assigned to Milestone
Armagetron Advanced
Fix Released
Critical
Manuel Moos

Bug Description

To reproduce:
1/ Write a map that has <setting name="USER_LEVEL" value="someguy@ 0"
2/ Set yourself as Administrator(1) on a server.
3/ Enter the game and use in-game admin to select your map
4/ /listadmins and see someguy@ is now Owner

Related branches

Revision history for this message
Yann Kaiser (epsy) wrote :
Changed in armagetronad:
importance: Undecided → Critical
milestone: none → 0.2.8.3
status: New → Confirmed
Revision history for this message
Manuel Moos (z-man) wrote :

Well spotted. Settings in map files are now executed with the access level of the one setting MAP_FILE. Error messages triggered are only reported on the server's stdout and I have no ambition to get them to the remote admin, too.

I've also made it a requirement to have a tCurrentAccessLevel object in every scope where settings are executed to prevent stuff like that from creeping up in other places. I adapted all the places I could find; but there may still be some assertion failures in tCurrentAccessLevel::GetAccessLevel(). Report those, please.

Changed in armagetronad:
assignee: nobody → z-man
status: Confirmed → Fix Committed
Manuel Moos (z-man)
Changed in armagetronad:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.