Feature Fix/Patch exploit of bot to crash/lag servers and clone items

[LucasFerraz]

Hello,
as some of you know there is an exploit using elfbot/magebot(...) to crash/lag server and possibiliting cloning.

Elf Hotkey to lag server:

auto 50 dropitemsxyzamount $posx [$posy+2] $posz 3590 1 |dropitemsxyzamount $posx [$posy+2] $posz 6569 1 |dropitemsxyzamount $posx [$posy+2] $posz 3591 1 |dropitemsxyzamount $posx [$posy+2] $posz 130 1 |dropitemsxyzamount $posx [$posy+2] $posz 3588 1

No matter if this key is used in a house or not, it will lag anyway.

How to fix
http://otland.net/f35/creatureevent-onmove-very-advanced-134016/

and

<event type="move" name="onMove" event="script" value="Custom/onMove.lua"/>

local storage = 61894
local exhause_time = 500 -- in milli seconds

local function resetStorage(cid)
    if isPlayer(cid) then
        setPlayerStorageValue(cid, storage, 0)
    end
end 
 
local function doExhaust(cid)
	-- exhaust divided by 1000 can be 0 (500 / 1000 = 0), but in onMoveItem(..) we check if time is >= os.time()
	setPlayerStorageValue(cid,storage,os.time()+(exhause_time / 1000))
	-- so if 'event' does not execute, it won't be a problem (just block for 1 second [not 0.5 sec] IF you relog)
	addEvent(resetStorage, exhause_time, cid)
end
 
function onMoveItem(cid, item, fromPosition, toPosition, fromItem, toItem, fromGround, toGround, status)
	-- and here we check time, not 1/0 value
	if getPlayerStorageValue(cid,storage) >= os.time() then
		doPlayerSendCancel(cid, "You cannot move objects that fast.")
		return false
	end
	doExhaust(cid)

	if (getTileInfo(fromPosition).house) then
		doPlayerSave(cid)
		doSaveHouse(getHouseFromPos(fromPosition))
	elseif (getTileInfo(toPosition).house) then
		doPlayerSave(cid)
		doSaveHouse(getHouseFromPos(toPosition))
	end
	return true
end

Thanks to Kito2.
Thanks to Gesior.pl for optimizing this script.
Thanks to Summ for adding check if player exist.

 

[Summ]

Check if the player still exists + reset storage onLogin.

 

[LucasFerraz]

Check if the player still exists + reset storage onLogin.

I do not understand what you mean

 

[HeberPcL]

LucasFerraz,
the "tileLimit" does not solve this problem?

 

[Evan]

I do not understand what you mean

I think what he's saying is that when you become "exhausted" then log off before the 500 milliseconds is up
the player can be exhausted forever until the storage value is reset back to 0.

 

[LucasFerraz]

I think what he's saying is that when you become "exhausted" then log off before the 500 milliseconds is up
the player can be exhausted forever until the storage value is reset back to 0.

I still didnt understand why of it. Is possible to crash re-logging a million times?

 

[Evan]

No, when you use this:

addEvent(setPlayerStorageValue,exhause_time,cid,storage,0)

when the player is offline, you cannot change storage value since cid is offline.
So, when the script is unable to change the storage value back to 0, the player is permanently stuck at value 1.
That's what I think he was saying.

 

[LucasFerraz]

I got it now but i didnt understand why she said it.
This script will only work if a player move an item (to move an item player must be online lol)

 

[Evan]

That's right, but the player can LOG OFF in the middle of the exhaust, right?
Lets say I move something, then log off before 500 milliseconds ends.

 

[LucasFerraz]

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA NOW I GOT IT OMG. HOW STUPID I'M!
Can you help to fix it?

 

[Evan]

Summ gave you a tip, you need to check if the player (cid) still exists.
Also, you just need to add a portion to the onLogin file to just simply set the player's storage value back to 0.

 

[RaikND]

Evan, why you dont try to make it for youself with one example??

Waiting for finish script

 

[LucasFerraz]

I will try it

 

[Gesior.pl]

local storage = 61894
local exhause_time = 500 -- in milli seconds
local function resetStorage(cid)
	if(isPlayer(cid)) then
		setPlayerStorageValue(cid, storage, 0)
	end
end 
 
local function doExhaust(cid)
	-- exhaust divided by 1000 can be 0 (500 / 1000 = 0), but in onMoveItem(..) we check if time is >= os.time()
	setPlayerStorageValue(cid,storage,os.time()+(exhause_time / 1000))
	-- so if 'event' does not execute, it won't be a problem (just block for 1 second [not 0.5 sec] IF you relog)
	addEvent(resetStorage,exhause_time,cid)
end
 
function onMoveItem(cid, item, formPosition, toPosition, fromItem, toItem, fromGround, toGround, status)
	-- and here we check time, not 1/0 value
	if getPlayerStorageValue(cid,storage) >= os.time() then
		doPlayerSendCancel(cid, "You can't move items that fast, please wait a few seconds.")
		return false
	end
	doExhaust(cid)
	return true
end

Version that works even if server restart/player relog

 

[Summ]

local storage = 61894
local exhause_time = 500 -- in milli seconds
 
local function resetStorage(cid)
    if isPlayer(cid) then
        setPlayerStorageValue(cid, storage, 0)
    end
end 
 
local function doExhaust(cid)
    -- exhaust divided by 1000 can be 0 (500 / 1000 = 0), but in onMoveItem(..) we check if time is >= os.time()
    setPlayerStorageValue(cid,storage,os.time()+(exhause_time / 1000))
    -- so if 'event' does not execute, it won't be a problem (just block for 1 second [not 0.5 sec] IF you relog)
    addEvent(resetStorage, exhause_time, cid)
end
 
function onMoveItem(cid, item, formPosition, toPosition, fromItem, toItem, fromGround, toGround, status)
	-- and here we check time, not 1/0 value
	if getPlayerStorageValue(cid,storage) >= os.time() then
		doPlayerSendCancel(cid, "You can't move items that fast, please wait a few seconds.")
		return false
	end
	doExhaust(cid)
	return true
end

 

[RaikND]

Summ scripts looks "more good coded" then Gesior, but i will try both!

 

[LucasFerraz]

I can't test it, can you do it RaikND?

 

[Summ]

Summ scripts looks "more good coded" then Gesior, but i will try both!

I just took gesior's as it is more safe and added the check if the player still exists when removing the storage so it won't throw errors.
So all credits to Gesior.

 

[LucasFerraz]

Thanks to Kito2.
Thanks to Gesior.pl for optimizing this script.
Thanks to Summ for adding check if player exist.

 

[Sir Gabriiel]

Where I put this?

local storage = 61894
local exhause_time = 500 -- in milli seconds
 
local function resetStorage(cid)
    if isPlayer(cid) then
        setPlayerStorageValue(cid, storage, 0)
    end
end 
 
local function doExhaust(cid)
    -- exhaust divided by 1000 can be 0 (500 / 1000 = 0), but in onMoveItem(..) we check if time is >= os.time()
    setPlayerStorageValue(cid,storage,os.time()+(exhause_time / 1000))
    -- so if 'event' does not execute, it won't be a problem (just block for 1 second [not 0.5 sec] IF you relog)
    addEvent(resetStorage, exhause_time, cid)
end
 
function onMoveItem(cid, item, formPosition, toPosition, fromItem, toItem, fromGround, toGround, status)
	-- and here we check time, not 1/0 value
	if getPlayerStorageValue(cid,storage) >= os.time() then
		doPlayerSendCancel(cid, "You can't move items that fast, please wait a few seconds.")
		return false
	end
	doExhaust(cid)
	return true
end