An admin of mine pointed out that there's a potentially BAD flaw in the mudprogs for SWR1.0
It appears that some of the mudprogs in mud_comm.c don't take CHARM into account. This allows a charmed mob to execute a mudprog command for a player. The most dangerous of these is 'mp_withdraw' which allows a mob to withdraw money from the local economy, then give it to the player.
Easy fix:
in act_comm.c find the do_order() function
Find this chunk of code about mid-function:
Add this directly after that: (note: this is AFTER the closing bracket of the else condition)
Recompile. You're good to go.
If you're REALLY want to play it safe or you have added functions that are similar to 'order' add this to the begining of every mpcommand in mud_comm.c that's missing it:
add it AFTER the IS_NPC check
It appears that some of the mudprogs in mud_comm.c don't take CHARM into account. This allows a charmed mob to execute a mudprog command for a player. The most dangerous of these is 'mp_withdraw' which allows a mob to withdraw money from the local economy, then give it to the player.
Easy fix:
in act_comm.c find the do_order() function
Find this chunk of code about mid-function:
if ( !IS_AFFECTED(victim, AFF_CHARM) || victim->master != ch )
{
send_to_char( "Do it yourself!\n\r", ch );
return;
}
}
Add this directly after that: (note: this is AFTER the closing bracket of the else condition)
if(strstr(argument,"mp"))
{
send_to_char("Huh?\n\r",ch);
return;
}
Recompile. You're good to go.
If you're REALLY want to play it safe or you have added functions that are similar to 'order' add this to the begining of every mpcommand in mud_comm.c that's missing it:
if ( IS_AFFECTED( ch, AFF_CHARM ) )
return;
add it AFTER the IS_NPC check