Skip to content

filter out fields that shouldn't be seen for KILL_PLAYER event, finer grain logic for communicating state for the event#224

Merged
AlecM33 merged 2 commits into
masterfrom
kill-player-fix
May 28, 2026
Merged

filter out fields that shouldn't be seen for KILL_PLAYER event, finer grain logic for communicating state for the event#224
AlecM33 merged 2 commits into
masterfrom
kill-player-fix

Conversation

@AlecM33

@AlecM33 AlecM33 commented May 28, 2026

Copy link
Copy Markdown
Owner
  • the KILL_PLAYER and ASSIGN_DEDICATED_MOD events were neglecting to invoke the GameStateCurator module to make sure game state is appropriately mapped per the user's permissions. This was causing us to erroneously include a persons cookie and socket ID, which are meant to be seen by the server only and could theoretically be used to assume the role and permissions of someone else during the game.

Fix

Fixes #223

  • Edit the events to use the game state curator to properly filter out certain fields.
  • Edit the "communicate" function for these events to make sure they are invoking different mapping logic for dedicated moderators vs. everyone else. In particular, if a player is killed and not revealed, moderators should still receive alignment information in the response, while everyone else should not. So if a given server instance has the moderator socket connected to it, communicate a different response to them vs. everyone else.

Testing

  • unit tests to verify key components of the fix
  • verified that the socket event no longer includes the cookie or socket ID for KILL_PLAYER and ASSIGN_DEDICATED_MOD:

Kill player

image

also verified the game state looks correct from all the different views (moderator, the player that was killed, and a spectator):

image image image

Assign Dedicated Mod -> Kill Player (When a temporary moderator kills the first player, as part of assigning a dedicated mod we also emit the kill player event)

image image image image

@AlecM33 AlecM33 merged commit cafc578 into master May 28, 2026
4 checks passed
@AlecM33 AlecM33 deleted the kill-player-fix branch May 28, 2026 18:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG]: Possibility to take over a users session

1 participant