WiredEffectTeleport Vulnerability Fix

This commit is contained in:
Harmonic 2020-02-08 07:02:34 -05:00
parent eb07ed91b2
commit 5c78088726
4 changed files with 20 additions and 36 deletions

View File

@ -42,7 +42,7 @@ public class WiredEffectTeleport extends InteractionWiredEffect {
}
public static void teleportUnitToTile(RoomUnit roomUnit, RoomTile tile) {
if (roomUnit == null || tile == null)
if (roomUnit == null || tile == null || roomUnit.isWiredTeleporting)
return;
Room room = roomUnit.getRoom();
@ -63,6 +63,7 @@ public class WiredEffectTeleport extends InteractionWiredEffect {
for (RoomTile optionalTile : optionalTiles) {
if (optionalTile.state != RoomTileState.INVALID && optionalTile.state != RoomTileState.BLOCKED) {
alternativeTile = optionalTile;
break;
}
}
@ -139,30 +140,13 @@ public class WiredEffectTeleport extends InteractionWiredEffect {
@Override
public boolean execute(RoomUnit roomUnit, Room room, Object[] stuff) {
THashSet<HabboItem> items = new THashSet<>();
for (HabboItem item : this.items) {
if (item.getRoomId() != this.getRoomId() || Emulator.getGameEnvironment().getRoomManager().getRoom(this.getRoomId()).getHabboItem(item.getId()) == null)
items.add(item);
}
for (HabboItem item : items) {
this.items.remove(item);
}
this.items.removeIf(item -> item == null || item.getRoomId() != this.getRoomId()
|| Emulator.getGameEnvironment().getRoomManager().getRoom(this.getRoomId()).getHabboItem(item.getId()) == null);
if (!this.items.isEmpty()) {
int i = Emulator.getRandom().nextInt(this.items.size()) + 1;
int j = 1;
int tryCount = 0;
while (tryCount < this.items.size()) {
tryCount++;
HabboItem item = this.items.get((tryCount - 1 + i) % this.items.size());
teleportUnitToTile(roomUnit, room.getLayout().getTile(item.getX(), item.getY()));
break;
}
int i = Emulator.getRandom().nextInt(this.items.size());
HabboItem item = this.items.get(i);
teleportUnitToTile(roomUnit, room.getLayout().getTile(item.getX(), item.getY()));
return true;
}
@ -220,6 +204,6 @@ public class WiredEffectTeleport extends InteractionWiredEffect {
@Override
protected long requiredCooldown() {
return 0;
return 50L;
}
}

View File

@ -30,6 +30,7 @@ import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.ScheduledFuture;
public class RoomUnit {
public boolean isWiredTeleporting = false;
private final ConcurrentHashMap<RoomUnitStatus, String> status;
private final THashMap<String, Object> cacheable;
public boolean canRotate = true;

View File

@ -194,19 +194,16 @@ public class WiredHandler {
if (effect != null && effect.canExecute(millis)) {
executed = true;
if (!effect.requiresTriggeringUser() || (roomUnit != null && effect.requiresTriggeringUser())) {
Emulator.getThreading().run(new Runnable() {
@Override
public void run() {
if (room.isLoaded()) {
try {
if (!effect.execute(roomUnit, room, stuff)) return;
effect.setCooldown(millis);
} catch (Exception e) {
Emulator.getLogging().logErrorLine(e);
}
effect.activateBox(room);
Emulator.getThreading().run(() -> {
if (room.isLoaded()) {
try {
if (!effect.execute(roomUnit, room, stuff)) return;
effect.setCooldown(millis);
} catch (Exception e) {
Emulator.getLogging().logErrorLine(e);
}
effect.activateBox(room);
}
}, effect.getDelay() * 500);
}

View File

@ -27,6 +27,7 @@ public class RoomUnitTeleport implements Runnable {
this.y = y;
this.z = z;
this.newEffect = newEffect;
roomUnit.isWiredTeleporting = true;
}
@Override
@ -53,6 +54,7 @@ public class RoomUnitTeleport implements Runnable {
ServerMessage teleportMessage = new RoomUnitOnRollerComposer(this.roomUnit, t, this.room).compose();
this.roomUnit.setLocation(t);
this.room.sendComposer(teleportMessage);
roomUnit.isWiredTeleporting = false;
this.room.updateHabbosAt(t.x, t.y);
this.room.updateBotsAt(t.x, t.y);