• Hey! Register here to create your account, engage with the community, and talk about what is new!

A [censored] up safety breach i just discovered

ImaLEAF

Forum adept
Emperor
Joined
Sep 20, 2021
Messages
155
Reaction score
23
@command event. I's extremely useful for help screens, suggestion systems, and even debug stuff. But there is an overpowered usage to it that nobody is safe to...

Keep in mind that Sunvortex is a fictional character, and I didn't actually use it against anyone.

The breach uses command arguments to send messages of any kind that are UNMARKED by default, so there's no way to know who used the command. For instance, if I use @chat Sunvortex: bruh this build is a [censored] piece of [censored] just like it's creator... Oh boy, this will probably get Sun banned.

"But I didn't say it!" Well, there's no evidence unless admins check plot code, what, to be honest, is rarely done in these situations.
"It only sends message on the plot!" Just like /c l.
"Can't /c n prove it's wrongness?" NOBODY uses /c n in a player interaction based game like in my example.
"How about swear filter?..." It's not perfect just like anything else.
"Welp, then we can just check devs?" If a command gets leaked trough Discord and has no restrictions, I'm very sorry. And you can't know who created that command either.

Even if Sun buys a rank, there is still Translate Color codes action. So I can do @chat &6[&aNoble&6]&f Sunvortex: n-word, and, boom.

EVEN WORSE! YOU CAN FAKE VOTE MESSAGES AND CREATE VOTE CHAINS BY DOING NOTHING!!!

...did i just break my favorite server by posting this

...and how tf do i expect it to be fixed

...maybe i shouldn't have lost faith in humanity...
 

ImaLEAF

Forum adept
Emperor
Joined
Sep 20, 2021
Messages
155
Reaction score
23
I'm really sorry if anything bad happens after this... I just wanted to point it out before someone else uses it.
 

froggy

Retired Moderator
Overlord
Joined
Sep 6, 2020
Messages
86
Reaction score
34
We do, actually, have a prevention method for this. If it is happening right in front of a moderator's eyes, they can check every message sent in the past few minutes through /mod log and see who truly sent the message.

If this were to happen to a player and slip under a moderator's radar, though, the player could appeal the punishment and the person who forged the evidence in the first place would receive a much harsher punishment.
 

PhoenixFire18

Forum adept
Overlord
Joined
Oct 28, 2020
Messages
357
Reaction score
51
All that does is trick the people on the plot into thinking about voting, so while it is manipulative, no real harm is caused by it.
 

Raffius Taffius

Well-known member
Overlord
Joined
Mar 17, 2022
Messages
86
Reaction score
21
Also who said you need to use the Translate Color Codes action to do color codes
 

Refrizor

Retired Administrator
Retired Admin
Joined
Aug 16, 2020
Messages
513
Reaction score
362
If this ever happens, send the plot ID & node to a moderator or admin. I don't think /report will work though as it will require the actual target user who violated the rule, so rather messaging a mod ingame, on Discord, or creating a report would be great. Same with signs which alerts us, a lot of these chat filter workarounds were put in place to avoid these scenarios which is great.

If you find any other chat workarounds though, feel free to create a ticket here in case the details are risky to be public to avoid exploiting, or send a message to any of the admins or mods and we'll escalate it to our team. If it's plausible, we'll have an internal discussion about it. Thank you though for sending it in though :))
 
Top Bottom