[Freeciv-Dev] Re: Clients can see supposedly invisible subs (PR#1405)

[Raimar Falke <hawk@xxxxxxxxxxxxxxxxxxxxxxx>]

On Wed, Apr 24, 2002 at 04:49:01PM -0700, Per I. Mathisen wrote:
> On Wed, 24 Apr 2002, Per I Mathisen wrote:
> > Information about subs that should be invisible are sent to clients just
> > like any other unit within non-fog-of-war territory.
> 
> Vasco also made me aware of bug #80, to which David Pfitzner wrote this:
> 
> > Date: Thu, 29 Jul 1999 19:03:25 +1000 (EST)
> > From: David Pfitzner <dwp@xxxxxxxxxxxxxx>
> > To: pejean.lists@xxxxxxxxx
> > CC: freeciv-dev@xxxxxxxxxxx, bugs@xxxxxxxxxxxxxxxxxxx
> > Subject: Re: [Freeciv-Dev] bug: server sends enemy cities information
> > (PR#80)
> >
> > "P.E.Jean"  <pejean.lists@xxxxxxxxx> wrote:
> >
> > > I found that the server sends information about enemy cities
> > > if the client requests it.
> >
> > Yes, the server sends more information than the client should
> > have.  

> > I think some things rely on this behaviour, such as
> > diplomats investigating cities.

This is correct and also mentioned in the code. No problem here.

> >  Similarly, a hacked client
> > could see all submarines

Not anymore with this patch.

> > see all units in enemy stacks and

How are stacks represented in the code?

> > in enemy cities

I doubt this (haven't checked the code).

> > , see exact enemy unit hp and veteran status,

Should we blur the HP?

> > get info on other players even without embassy (?), etc.

I doubt this (haven't checked the code).

Attached patch does:
 - audit all city and unit related handle methods (no error was
 found). So the hole mentioned in (PR#80) is closed.
 - changed all city and unit related handle methods to follow the same
 style. Remove stupid things like:

  struct unit *punit = player_find_unit_by_id(pplayer, req->unit_id);
...
  if (unit_owner(punit) != pplayer) {
    freelog(LOG_ERROR, "%s trying to paradrop a non-owner unit!\n",
       pplayer->name);
    return;
  }

 - cleanup of is_hiding_unit and player_can_see_unit
 - add a check for player_can_see_unit into send_unit_info_*

> I think these things should be fixed.

I wish you happy reviewing ;)

        Raimar

-- 
 email: rf13@xxxxxxxxxxxxxxxxx
 "Transported to a surreal landscape, a young girl kills the first woman
  she meets and then teams up with three complete strangers to kill again."
    -- TV listing for the Wizard of Oz in the Marin Independent Journal

input_checking_invis1.diff
Description: Text document