Page 1 of 1
player can manage any map
Posted: November 7th, 2011, 6:49 am
by Hellenion
A player with manageWorlds permission can remove/overwrite any map, even maps that are above the player's rank.
related:
a player can set WBuild to above his own rank without warning. (possibly irreversible)
I actually have been using this bug for a long time before I realized it shouldn't be possible.
Re: player can manage any map
Posted: November 7th, 2011, 7:01 am
by Lim-Dul
I don't think that's a bug. This is how the Manage Worlds permission works and why it's a very powerful one that you shouldn't give to everyone.
On a conceptual level - how would you stop players with Manage Worlds to do what you described? The can load/unload maps, generate new ones and so on.
The only way I would see is for them to not be able to manage worlds above their rank but this still would solve just one aspect of the Manage Worlds permission and would only apply to loaded worlds...
Re: player can manage any map
Posted: November 7th, 2011, 7:17 am
by Hellenion
I'm not having problems with people deleting my maps or anything, it just struck me that I was able to overwrite maps that I weren't allowed to build on.
Checking if a player has permission to edit the map before overwriting/removing would really prevent them from editing that map. I'm not worried about loading stuff, that doesn't have any irreversible effects.
And yes, it would only apply to loaded worlds.
Re: player can manage any map
Posted: November 7th, 2011, 3:11 pm
by Lim-Dul
Hellenion wrote:I'm not worried about loading stuff, that doesn't have any irreversible effects.
Yes it would. You save a new world under the name of an unloaded one et voila - overwritten. But let's wait to see what the mighty fragmer can do.
Re: player can manage any map
Posted: November 7th, 2011, 11:29 pm
by fragmer
"A player with manageWorlds permission can remove/overwrite any map, even maps that are above the player's rank." - Right now permissions are not saved in a map file (.fcm), only in the world list file (worlds.xml). I guess need to add a couple things:
- Add a check to /WLoad, /Gen, and /WSave to see if the mapfile is associated with a loaded world, and check its permissions.
- If it's not loaded, check if mapfile has embedded permissions (which I will start saving soon) from the last time that it's been associated with a world. Maybe.
Related:
"A player can set WBuild to above his own rank without warning." - Well, it's their fault
