From 924fbc78f755bcd2917334bd28519bb614babac0 Mon Sep 17 00:00:00 2001 From: cheapie Date: Sun, 26 Jul 2026 10:33:26 -0500 Subject: Check controller/dispatcher protection when connecting call buttons/kiosks This prevents players from reaching locked floors by connecting their own call buttons --- callbuttons.lua | 13 ++++++++++++- dbdkiosk.lua | 5 +++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/callbuttons.lua b/callbuttons.lua index 2c36147..432ef19 100644 --- a/callbuttons.lua +++ b/callbuttons.lua @@ -242,11 +242,22 @@ for _,state in ipairs(validstates) do fs = fs.."button[3,3.5;2,1;save;"..savemsg.."]" meta:set_string("formspec",fs) end, - on_receive_fields = function(pos,_,fields) + on_receive_fields = function(pos,_,fields,player) if tonumber(fields.carid) and tonumber(fields.landing) then local carid = tonumber(fields.carid) local carinfo = core.deserialize(celevator.storage:get_string(string.format("car%d",carid))) if not carinfo then return end + local controllerpos = carinfo.controllerpos or carinfo.dispatcherpos + local playername = player and player:get_player_name() or "" + if core.is_protected(controllerpos,playername) and not core.check_player_privs(playername,{protection_bypass=true}) then + core.record_protection_violation(controllerpos,playername) + if carinfo.controllerpos then + core.chat_send_player(playername,S("Can't connect to a controller you don't have access to.")) + else + core.chat_send_player(playername,S("Can't connect to a dispatcher you don't have access to.")) + end + return + end table.insert(carinfo.callbuttons,{pos=pos,landing=tonumber(fields.landing)}) celevator.storage:set_string(string.format("car%d",carid),core.serialize(carinfo)) local meta = core.get_meta(pos) diff --git a/dbdkiosk.lua b/dbdkiosk.lua index 4d15403..4193cbf 100644 --- a/dbdkiosk.lua +++ b/dbdkiosk.lua @@ -77,6 +77,11 @@ function celevator.dbdkiosk.handlefields(pos,_,fields,player) local carinfo = core.deserialize(celevator.storage:get_string(string.format("car%d",fields.carid))) if not carinfo then return end if not (carinfo.dispatcherpos and celevator.dispatcher.isdispatcher(carinfo.dispatcherpos)) then return end + if core.is_protected(carinfo.dispatcherpos,name) and not core.check_player_privs(name,{protection_bypass=true}) then + core.record_protection_violation(carinfo.dispatcherpos,name) + core.chat_send_player(name,S("Can't connect to a dispatcher you don't have access to.")) + return + end local dmem = core.deserialize(core.get_meta(carinfo.dispatcherpos):get_string("mem")) if not dmem then return end local floornames = dmem.params.floornames -- cgit v1.2.3