bug #1903

src/client/ui/templates/online/online.js

@@ -168,7 +168,9 @@ define([
 			client.request({
 				cpn: 'social',
 				method: 'getInvite',
-				id: charId
+				data: {
+					targetId: charId
+				}
 			});
 		}
 	};

src/client/ui/templates/party/party.js

@@ -196,7 +196,9 @@ define([
 			client.request({
 				cpn: 'social',
 				method: 'acceptInvite',
-				id: this.invite.fromId
+				data: {
+					targetId: this.invite.fromId
+				}
 			});
 		},
 
@@ -204,9 +206,8 @@ define([
 			client.request({
 				cpn: 'social',
 				method: 'declineInvite',
-				id: this.invite.fromId,
 				data: {
-					targetId: window.player.serverId
+					targetId: this.invite.fromId
 				}
 			});
 		},

src/server/components/inventory.js

@@ -208,8 +208,11 @@ module.exports = {
 	},
 
 	splitStack: function (msg) {
+		let { stackSize = 1 } = msg;
+		stackSize = ~~stackSize;
+
 		let item = this.findItem(msg.itemId);
-		if (!item || !item.quantity || item.quantity <= msg.stackSize || msg.stackSize < 1 || item.quest)
+		if (!item || !item.quantity || item.quantity <= stackSize || stackSize < 1 || item.quest)
 			return;
 
 		const hasSpace = this.hasSpace(item, true);
@@ -219,8 +222,8 @@ module.exports = {
 		}
 
 		let newItem = extend({}, item);
-		item.quantity -= msg.stackSize;
-		newItem.quantity = msg.stackSize;
+		item.quantity -= stackSize;
+		newItem.quantity = stackSize;
 
 		this.getItem(newItem, true, true);
 

src/server/components/portal/sendObjToZone.js

@@ -36,6 +36,8 @@ const sendObjToZone = async ({ obj, invokingObj, zoneName, toPos, toRelativePos
 		return;
 	}
 
+	obj.fireEvent('beforeRezone');
+
 	//We set this before saving so that objects aren't saved ON portals
 	obj.zoneName = zoneName;
 	fixPosition(obj, toPos, toRelativePos, invokingObj);

src/server/security/connections.js

@@ -1,5 +1,10 @@
-let objects = require('../objects/objects');
+//External Modules
+const objects = require('../objects/objects');
 
+//Helpers
+const { route, routeGlobal } = require('./connections/route');
+
+//Module
 module.exports = {
 	players: [],
 
@@ -57,56 +62,11 @@ module.exports = {
 	},
 
 	route: function (socket, msg) {
-		let player = null;
-
-		if (msg.id) {
-			player = this.players.find(p => p.id === msg.id);
-			let source = this.players.find(p => p.socket.id === socket.id);
-			if (!source)
-				return;
-			if (!msg.data)
-				msg.data = {};
-			msg.data.sourceId = source.id;
-		} else
-			player = this.players.find(p => p.socket.id === socket.id);
-
-		if (
-			(!player) ||
-			(
-				(player.permadead) &&
-				(['getCharacterList', 'getCharacter', 'deleteCharacter'].indexOf(msg.method) === -1)
-			) ||
-			(
-				player.dead &&
-				!(
-					(msg.method === 'performAction' && ['respawn'].includes(msg.data.method)) ||
-					(msg.method === 'clientAck')
-				)
-			)
-		)
-			return;
-
-		if (msg.threadModule) {
-			const source = this.players.find(p => p.socket.id === socket.id);
-			if (!source)
-				return;
-
-			if (msg.callback)
-				msg.data.callbackId = atlas.registerCallback(msg.callback);
-
-			msg.data.sourceId = source.id;
-			atlas.send(player.zone, msg);
-
-			return;
-		}
-
-		let cpn = player[msg.cpn];
-		if (!cpn)
-			return;
+		route.call(this, socket, msg);
+	},
 
-		let method = msg.method;
-		if (cpn[method])
-			cpn[method](msg);
+	routeGlobal: function (msg) {
+		routeGlobal.call(this, msg);
 	},
 
 	unzone: function (msg) {
@@ -164,11 +124,12 @@ module.exports = {
 			if ((!p) || (p === exclude) || (!p.auth))
 				continue;
 
-			if (p.name && p.zoneName)
-				await atlas.forceSavePlayer(p.name, p.zoneName);
+			if (p.auth.username === exclude.auth.username) {
+				if (p.name && p.zoneName)
+					await atlas.forceSavePlayer(p.name, p.zoneName);
 
-			if (p.auth.username === exclude.auth.username)
 				p.socket.emit('dc', {});
+			}
 		}
 	},
 

src/server/security/connections/route.js

@@ -0,0 +1,58 @@
+const route = function (socket, msg) {
+	const source = this.players.find(p => p.socket.id === socket.id);
+	if (!source)
+		return;
+
+	if (!msg.data)
+		msg.data = {};
+
+	msg.data.sourceId = source.id;
+
+	if (
+		(
+			(source.permadead) &&
+			(['getCharacterList', 'getCharacter', 'deleteCharacter'].indexOf(msg.method) === -1)
+		) ||
+		(
+			source.dead &&
+			!(
+				(msg.method === 'performAction' && ['respawn'].includes(msg.data.method)) ||
+				(msg.method === 'clientAck')
+			)
+		)
+	)
+		return;
+
+	if (msg.threadModule) {
+		if (msg.callback)
+			msg.data.callbackId = atlas.registerCallback(msg.callback);
+
+		atlas.send(source.zone, msg);
+
+		return;
+	}
+
+	let target = source;
+	if (msg.data.targetId !== undefined) {
+		target = this.players.find(p => p.id === msg.data.targetId);
+		if (!target)
+			return;
+	}
+
+	let cpn = target[msg.cpn];
+	if (!cpn)
+		return;
+
+	let method = msg.method;
+	if (cpn[method])
+		cpn[method](msg);
+};
+
+const routeGlobal = function (msg) {
+	global[msg.module][msg.method](msg);
+};
+
+module.exports = {
+	route,
+	routeGlobal
+};

src/server/security/router.js

@@ -1,4 +1,4 @@
-const { routerConfig: { allowed, secondaryAllowed, globalAllowed, allowTargetId } } = require('./routerConfig');
+const { routerConfig: { allowed, allowTargetId, secondaryAllowed, globalAllowed, secondaryAllowTargetId } } = require('./routerConfig');
 
 module.exports = {
 	allowedCpn: function (msg) {
@@ -8,15 +8,22 @@ module.exports = {
 		if (!valid)
 			return false;
 
-		if (!secondaryCpn)
+		if (!secondaryCpn) {
+			if (targetId !== undefined) {
+				const canHaveTargetId = allowTargetId?.[cpn]?.includes(method);
+				if (!canHaveTargetId)
+					return false;
+			}
+
 			return true;
+		}
 
 		const secondaryValid = secondaryAllowed?.[secondaryCpn]?.includes(secondaryMethod);
 		if (!secondaryValid)
 			return false;
 
 		if (targetId !== undefined) {
-			const canHaveTargetId = allowTargetId?.[secondaryCpn]?.includes(secondaryMethod);
+			const canHaveTargetId = secondaryAllowTargetId?.[secondaryCpn]?.includes(secondaryMethod);
 			if (!canHaveTargetId)
 				return false;
 		}

src/server/security/routerConfig.js

@@ -1,11 +1,18 @@
 let events = require('../misc/events');
 
 const routerConfig = {
+	//Component methods that can be called on the main thread
 	allowed: {
 		player: ['performAction', 'queueAction', 'move'],
 		auth: ['login', 'register', 'play', 'getCharacterList', 'getCharacter', 'deleteCharacter', 'getSkinList', 'createCharacter', 'getCustomChannels'],
 		social: ['chat', 'getInvite', 'acceptInvite', 'declineInvite', 'removeFromParty', 'leaveParty']
 	},
+	//Component methods that can be called with a targetId
+	// which means that we're not calling our own component method but instead, another object's component method
+	allowTargetId: {
+		social: ['getInvite', 'acceptInvite', 'declineInvite']
+	},
+	//Component methods that can be called on map threads through `performAction` or `queueAction` methods
 	secondaryAllowed: {
 		dialogue: ['talk'],
 		gatherer: ['gather'],
@@ -20,21 +27,24 @@ const routerConfig = {
 		passives: ['tickNode', 'untickNode'],
 		workbench: ['open', 'craft', 'getRecipe']
 	},
-	globalAllowed: {
-		clientConfig: ['getClientConfig'],
-		leaderboard: ['requestList'],
-		cons: ['unzone'],
-		rezoneManager: ['clientAck'],
-		instancer: ['clientAck']
-	},
-	allowTargetId: {
+	//Component methods that can be called on map threads with a targetId
+	// which means that we're not calling our own component method but instead, another object's component method
+	// These are called through `performAction` or `queueAction` methods
+	secondaryAllowTargetId: {
 		door: ['lock', 'unlock'],
 		gatherer: ['gather'],
 		equipment: ['inspect'],
 		stash: ['open'],
-		social: ['declineInvite'],
 		wardrobe: ['open', 'apply'],
 		workbench: ['open', 'craft', 'getRecipe']
+	},
+	//Global module methods that can be called on the main thread or map threads
+	globalAllowed: {
+		clientConfig: ['getClientConfig'],
+		leaderboard: ['requestList'],
+		cons: ['unzone'],
+		rezoneManager: ['clientAck'],
+		instancer: ['clientAck']
 	}
 };
 

src/server/server/onConnection.js

@@ -43,7 +43,7 @@ const onRequest = (socket, msg, callback) => {
 		if (source)
 			msg.data.sourceId = source.id;
 
-		global[msg.module][msg.method](msg);
+		cons.routeGlobal(msg);
 	}
 };