Graal Forums  

Go Back   Graal Forums > Development Forums > NPC Scripting > Code Gallery
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Search this Thread Display Modes
  #16  
Old 01-03-2013, 06:09 PM
ff7chocoboknight ff7chocoboknight is offline
Skyzer Zolderon
ff7chocoboknight's Avatar
Join Date: Dec 2006
Location: New Hampshire, United States
Posts: 725
ff7chocoboknight is a glorious beacon of lightff7chocoboknight is a glorious beacon of lightff7chocoboknight is a glorious beacon of light
Send a message via AIM to ff7chocoboknight Send a message via MSN to ff7chocoboknight
Dsider trollin' the nerds. lol
__________________
Reply With Quote
  #17  
Old 01-03-2013, 11:07 PM
Gunderak Gunderak is offline
Coder
Gunderak's Avatar
Join Date: Jun 2011
Location: Australia
Posts: 795
Gunderak is on a distinguished road
Send a message via Skype™ to Gunderak
Quote:
Originally Posted by BlueMelon View Post
Graal Script Code:
  if(params[0] == "Buy"){
    
temp.rate Stocks.stock_price.(@params[1]);
    
temp.amnt params[2];
    
temp.price amnt*rate;
    if(
clientr.stockcash >= price){
      
clientr.stockcash -= price;
      
clientr.stocks.(@int(random(1,9999999)))= {params[1], rateamnt};
      
clientr.stockcash clientr.stockcash.substring(0clientr.stockcash.pos(".") + 3);
    }
  }
  if(
params[0] == "Sell"){
    
temp.rate Stocks.stock_price.(@params[1]);
    for(
temp.getstringkeys("clientr.stocks.")){
      
temp.amnt clientr.stocks.(@i)[2];
      
temp.price amnt*rate;
      
temp.checkname clientr.stocks.(@i)[0];
      if(
checkname == params[1]){
        
temp.checkrate clientr.stocks.(@i)[1];
        if(
checkrate.pos(params[2]) >= 0){
          
temp.checkquantity clientr.stocks.(@i)[2];
          if(
checkquantity == params[3]){;
            if(
clientr.stocks.(@i) == null) return;
            
clientr.stocks.(@i) = null;
            
clientr.stockcash += price;
            return;
          }
        }
      }
    }
  } 
No validation? Huge security holes... What if params[1] or params[2] was negative?
clientr.stockcash -= -(price);

See where I'm going?
No validation?
It checks with the database NPC.
And I haven't thought about if stocks are that negative.
Generally people don't buy negative stocks..
And it does check if your money is greater than or equal to the stock you're buying.
And the priced is taken from the DB NPC.
__________________

Gund for president.

Remote PM {P*}x (Graal813044) from eraiphone -> Stefan: I hav 1 qustion
*Gunderak: he hav 1
*Gunderak: qustion

Last edited by Gunderak; 01-03-2013 at 11:41 PM..
Reply With Quote
  #18  
Old 01-03-2013, 11:58 PM
BlueMelon BlueMelon is offline
asdfg
BlueMelon's Avatar
Join Date: Sep 2008
Posts: 1,481
BlueMelon is a splendid one to beholdBlueMelon is a splendid one to beholdBlueMelon is a splendid one to beholdBlueMelon is a splendid one to behold
Validation as in, are you getting the right input? What if the triggers value (from clientside) was modified to send a negative value in the trigger? (Happened on era, that's why I'm saying this)
__________________
http://i.imgur.com/OOJbW.jpg
Reply With Quote
  #19  
Old 01-04-2013, 12:03 AM
DustyPorViva DustyPorViva is offline
Will work for food. Maybe
DustyPorViva's Avatar
Join Date: Sep 2003
Location: Maryland, USA
Posts: 9,589
DustyPorViva has a reputation beyond reputeDustyPorViva has a reputation beyond reputeDustyPorViva has a reputation beyond reputeDustyPorViva has a reputation beyond reputeDustyPorViva has a reputation beyond reputeDustyPorViva has a reputation beyond reputeDustyPorViva has a reputation beyond reputeDustyPorViva has a reputation beyond reputeDustyPorViva has a reputation beyond reputeDustyPorViva has a reputation beyond reputeDustyPorViva has a reputation beyond repute
Send a message via AIM to DustyPorViva Send a message via MSN to DustyPorViva
Checking for things like negative input is something you really need to get into a habit of doing. That kind of **** is what will let a player walk away from a bank with a free million dollars/gralats.
Reply With Quote
  #20  
Old 01-04-2013, 12:38 AM
smirt362 smirt362 is offline
Tee Hee
smirt362's Avatar
Join Date: Feb 2005
Location: Texas
Posts: 2,101
smirt362 has a brilliant futuresmirt362 has a brilliant futuresmirt362 has a brilliant futuresmirt362 has a brilliant futuresmirt362 has a brilliant futuresmirt362 has a brilliant futuresmirt362 has a brilliant future
Send a message via AIM to smirt362 Send a message via MSN to smirt362
Quote:
Originally Posted by DustyPorViva View Post
Checking for things like negative input is something you really need to get into a habit of doing. That kind of **** is what will let a player walk away from a bank with a free million dollars/gralats.
Delteria's banking system was like this
__________________

Don Hertzfeldt <3
Reply With Quote
  #21  
Old 01-04-2013, 01:02 AM
Hezzy002 Hezzy002 is offline
Registered User
Join Date: Jul 2011
Posts: 247
Hezzy002 is a jewel in the roughHezzy002 is a jewel in the rough
Quote:
Originally Posted by Gunderak View Post
No validation?
It checks with the database NPC.
And I haven't thought about if stocks are that negative.
Generally people don't buy negative stocks..
And it does check if your money is greater than or equal to the stock you're buying.
And the priced is taken from the DB NPC.
-rep for being retarded
Reply With Quote
  #22  
Old 01-04-2013, 03:16 AM
Gunderak Gunderak is offline
Coder
Gunderak's Avatar
Join Date: Jun 2011
Location: Australia
Posts: 795
Gunderak is on a distinguished road
Send a message via Skype™ to Gunderak
The value can't be negative. As you can't buy - stocks.
I'll add an extra check anyway..
__________________

Gund for president.

Remote PM {P*}x (Graal813044) from eraiphone -> Stefan: I hav 1 qustion
*Gunderak: he hav 1
*Gunderak: qustion

Last edited by Darlene159; 01-04-2013 at 04:30 PM.. Reason: No need for that
Reply With Quote
  #23  
Old 01-04-2013, 03:50 AM
xXziroXx xXziroXx is offline
Master of Puppets
xXziroXx's Avatar
Join Date: May 2004
Location: Sweden
Posts: 5,288
xXziroXx has a brilliant futurexXziroXx has a brilliant futurexXziroXx has a brilliant futurexXziroXx has a brilliant futurexXziroXx has a brilliant futurexXziroXx has a brilliant futurexXziroXx has a brilliant future
Send a message via AIM to xXziroXx Send a message via MSN to xXziroXx
Quote:
Originally Posted by Gunderak View Post
The value can't be negative. As you can't buy - stocks.
I'll add an extra check anyway..
You have t o realize that any clientsided code can be altered with various memory editors and whatnot, thus, anyone with the knowledge and enough free time on their hands can modify the trigger and send a negative value with it. ALWAYS make sure things are as they should be on clientside AND serverside.
__________________

"A delayed game is eventually good, but a rushed game is forever bad." - Shigeru Miyamoto

Last edited by Darlene159; 01-04-2013 at 04:30 PM..
Reply With Quote
  #24  
Old 01-04-2013, 03:51 AM
BlueMelon BlueMelon is offline
asdfg
BlueMelon's Avatar
Join Date: Sep 2008
Posts: 1,481
BlueMelon is a splendid one to beholdBlueMelon is a splendid one to beholdBlueMelon is a splendid one to beholdBlueMelon is a splendid one to behold
Quote:
Originally Posted by Gunderak View Post
The value can't be negative. As you can't buy - stocks.
I'll add an extra check anyway..
Since you are sending the values FROM client-side, TO server-side, they can be edited before sending the values. The trigger params can be edited by anyone who knows how. Always do serverside validation, making sure you have the correct values...
__________________
http://i.imgur.com/OOJbW.jpg

Last edited by Darlene159; 01-04-2013 at 04:30 PM..
Reply With Quote
Reply

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT +2. The time now is 12:54 AM.


Powered by vBulletin® Version 3.8.3
Copyright ©2000 - 2019, Jelsoft Enterprises Ltd.
Copyright (C) 1998-2008 Linux cyberjoueurs All Rights Reserved.