[Freeciv-Dev] Re: the things i dislike about freeciv

[Gaute Strokkenes <gs234@xxxxxxxxxxxxx>]

Erik Sigra <freeciv@xxxxxxx> writes:

> Jamie Kawabata wrote:

> City name suggestions have also been discussed before. It is
> security-crittical.

They're not _security_ critical.  You can't (as far as I know ;-) make
the server crash and/or execute arbitrary code by coming us with silly
city names.

However, the the rather primitive name handling can be used to cheat.
I think I've already mentioned the 'Gautestad' cheat, where you give
all (or, more realistically if you want to get away with it, just one)
of your normal cities the same name as your capital in the hope that
your real capital will not be discovered.  Or consider the
find_city_by_name() function, which is a bug in itself.  But then if
you require city names to be unique, you can cycle through your
opponent's (default) city names in order to see how many they have...

Suggested solution:

* Require city names to be unique within each nation.

* Get rid of find_city_by_name() .  Replace with calls to
  exists_city_with_name() or somesuch where appropriate, and rewrite
  everything else.

* Make city name suggestions slightly more intelligent.

These can all be carried out independently, and I will produce a patch
to do so if the Freeciv developers indicated that they agree with my
approach.  The only aber is the second point, since
find_city_by_name() is used in places in the client that I don't feel
comfortable fiddling around with, notably the Xaw code.

> So are flags. Someone could upload a flag that differs slightly in
> just 1 pixel from some other flag, to confuse the opponents.

But if you did, everyone else would find you out, wouldn't they?

-- 
GS