Market System Cloning items

We need to know how it happens in order to deliver a fix.

If you don't want to share the steps to clone items publicly, you can pm anyone with "tfs developer" tag (eg. nekiro/epuncker) and they can keep it secret until we post a bugfix. I can help them investigate.

Mods please make an exception from the "offering help via pm" rule. The solution will be free, it's a matter of servers security.

Exactly, it would be discretion, since I tested on servers with 300 people, and it could be easily cloned.
the error is not found on all servers, but on most multi version.

dfs1 said:

I really don't know how to solve that, that's why I ask for help but I don't want everyone to know this because it would be chaos for the servers that are already open.

Click to expand...

There were many bugs in otservbr market/gamestore that let people clone items/money/TC. otservbr owners should be prepared.

That's the importance of keeping your base up to date and raise issues. Only creating awareness we can investigate.
Back when we were still using 10-12 fork there was a clone of coins happening but no one was reporting, plus most otadmins didn't knew how to replicate. A couple of servers were not affected as they bought the fix without ever telling us about it, it took my whole weekend to debug and find where the problem was and half of the otadmins had bought the fix already and were also not willing to share.

zbizu said:

Tested on 1.4, 1.4.1, master branch and my fork.

Tfs: Not bugged.
Canary: probably not bugged (looking at the code)
old otbr engine: probably bugged (looking at the code)

The bugged instruction:
https://github.com/opentibiabr/otse...e5a1acd9480733338f065/src/game/game.cpp#L7470 (note: this is outdated, otservbr-global uses canary now afaik)

The situation that isn't handled in the code above:

https://github.com/otland/forgottenserver/blob/bb41780b4de190206662b4cd36ebeee39365f2f8/src/game.cpp#L5178

tl;dr fix: copy the "if" block with "return" statement from the second link to your server and compile

Click to expand...

Im not so familiar with TFS code, but running the code inside the
If(!itemList.empty()) {xxx}

Isn't the same check as using the return in case itemList is empty?

I didn't got why the second one is safe and the first one is bugged

Night Wolf said:

plus most otadmins didn't knew how to replicate. A couple of servers were not affected as they bought the fix without ever telling us about it

Click to expand...

Ye. That's a problem. Big OTS owners know these bugs, but do not tell anyone. They use them to destroy servers of competitors.
I would not care about publishing bugs like that with reason "what would happen to big otses". THEY do not care about open source community. We should not care about them.

Sometimes I work for big 12+ OTSes. They are ready to pay up to 10 times more, if I do not publish fixes on github.

Gesior.pl said:

Ye. That's a problem. Big OTS owners know these bugs, but do not tell anyone. They use them to destroy servers of competitors.
I would not care about publishing bugs like that with reason "what would happen to big otses". THEY do not care about open source community. We should not care about them.

Sometimes I work for big 12+ OTSes. They are ready to pay up to 10 times more, if I do not publish fixes on github.

Click to expand...

I've been there, but luckily for me I'm only here for learning and hobby and I usually turn down clients that don't care about sharing crashes with the open source community. We need ASAP to convince those people to migrate to a "bounty" format because this is starting to bite otadmins in the back already.
Most of the servers have a short timespan so eventually they run out of budget to keep fixing new things that are getting discovered/developed to exploit.

Is there a solution for this?

The same thing happened on my server, only they don't clone tc's, only money and items. They don't even clone them. They make them appear, I started my server yesterday at 4:00 pm and at 4:20 they already had soul war items and many more things here I leave a photo of the player account that came in

adrenyslopez said:

Is there a solution for this?

Click to expand...