diff --git a/changelog.txt b/changelog.txt index 4b2d029d5..a1a4e264c 100644 --- a/changelog.txt +++ b/changelog.txt @@ -1,5 +1,8 @@ EQEMu Changelog (Started on Sept 24, 2003 15:50) ------------------------------------------------------- +== 21/01/2016 == +Uleat: Disabled RoF+ clients from augmentation items not in their possessions slots (0-29, 9999, 251-330) to abate an exploit in the current code + == 10/17/2016 == Uleat: Moved namespace ItemField from item_instance.h to shareddb.cpp - the only place it is used Uleat: Separated class Inventory from item_instance files into inventory_profile files diff --git a/zone/client_packet.cpp b/zone/client_packet.cpp index e05cc4f8c..a28327196 100644 --- a/zone/client_packet.cpp +++ b/zone/client_packet.cpp @@ -2933,6 +2933,19 @@ void Client::Handle_OP_AugmentItem(const EQApplicationPacket *app) bool deleteItems = false; if (ClientVersion() >= EQEmu::versions::ClientVersion::RoF) { + if ((in_augment->container_slot < 0 || in_augment->container_slot >= EQEmu::legacy::SLOT_CURSOR) && + in_augment->container_slot != EQEmu::legacy::SLOT_POWER_SOURCE && + (in_augment->container_slot < EQEmu::legacy::SLOT_PERSONAL_BAGS_BEGIN || in_augment->container_slot > EQEmu::legacy::SLOT_PERSONAL_BAGS_END)) + { + Message(13, "The server does not allow augmentation actions from this slot."); + auto cursor_item = m_inv[EQEmu::legacy::SLOT_CURSOR]; + auto augmented_item = m_inv[in_augment->container_slot]; + SendItemPacket(EQEmu::legacy::SLOT_CURSOR, cursor_item, ItemPacketCharInventory); + // this may crash clients on certain slots + SendItemPacket(in_augment->container_slot, augmented_item, ItemPacketCharInventory); + return; + } + EQEmu::ItemInstance *itemOneToPush = nullptr, *itemTwoToPush = nullptr; //Log.Out(Logs::DebugLevel::Moderate, Logs::Debug, "cslot: %i aslot: %i cidx: %i aidx: %i act: %i dest: %i",