[Freeciv-Dev] (PR#13617) crazy bug with SSET_SERVER_ONLY

["Jason Short" <jdorje@xxxxxxxxxxxxxxxxxxxxx>]

<URL: http://bugs.freeciv.org/Ticket/Display.html?id=13617 >

Connect with the client to a server you don't have HACK access on.

/show endyear
/show saveturns
/set endyear -3950
/set saveturns 5
/show gameseed
/set gameseed 12345

------>

/show: Sorry, you do not have access to view option 'endyear'.
/show: Sorry, you do not have access to view option 'saveturns'.
New vote (number 0) by jdorje: set endyear -3950.
Vote "set endyear -3950" is passed 1 to 0 with 0 abstentions.
(server prompt): 'set endyear -3950'
/show: Sorry, you do not have access to view option 'endyear'.
New vote (number 1) by jdorje: set saveturns 5.
Vote "set saveturns 5" is passed 1 to 0 with 0 abstentions.
(server prompt): 'set saveturns 5'
/show: Sorry, you do not have access to view option 'gameseed'.
New vote (number 2) by jdorje: set gameseed 12345.
Vote "set gameseed 12345" is passed 1 to 0 with 0 abstentions.
(server prompt): 'set gameseed 12345'

Because of voting even SSET_SERVER_ONLY settings may be set by the 
client (may_set_option tells, correctly, that the client can't set this 
setting but voting overrules this and instigates a vote anyway). 
However /show will not work because this info-level command is not 
eligible for voting.  This is a major problem since it makes cheating 
incredibly easy (just set the mapseed before a game and nobody will know).

I don't see how voting can be fixed to deal with this.  Maybe I'm 
missing something though.  However this really must be fixed.  My only 
other suggestions are to drop voting or to remove the 
SSET_TO_CLIENT/SSET_SERVER_ONLY values entirely.

Another bug is that the client is told about these settings via the 
options packets.  This is surely an oversight in that code; it allows 
the setting to be visible in the dialog but not via /show.

All of these behaviors may differ slightly in 2.0 and the development 
version.  The above tests are with the dev version.

-jason