ZB-Server/EscapeFromTeacher
Private
Public Access
1
0
Fork 0
Code Activity

fix game
All checks were successful
Dynamic Branch Deploy / build-and-deploy (push) Successful in 8m20s

Browse Source
This commit is contained in:
Sebastian Unterschütz
2026-03-21 13:31:34 +01:00
parent 78742fc1c4
commit f48ade50bb
6 changed files with 130 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
pkg/server/gateway.go
View File

@@ -146,17 +146,16 @@ func (gw *Gateway) HandleWS(w http.ResponseWriter, r *http.Request) {
continue // Ignoriere böswilligen Input
}
// 🔒 SECURITY: Setze IMMER die korrekten IDs (überschreibe Client-Werte)
input := game.ClientInput{
Type: inputType,
RoomID: roomID, // Server setzt den Raum (nicht Client!)
PlayerID: playerID, // Server setzt die Player-ID (nicht Client!)
}
// 🔒 SECURITY: Alle Input-Felder übernehmen, aber IDs immer vom Server setzen
// Remarshal des raw-Objekts in ClientInput um alle Felder (inkl. STATE-Felder) zu übernehmen
inputBytes, _ := json.Marshal(raw)
var input game.ClientInput
json.Unmarshal(inputBytes, &input)
// Sequence-Nummer vom Client übernehmen (für Client Prediction)
if seq, ok := raw["sequence"].(float64); ok {
input.Sequence = uint32(seq)
}
// Security-kritische Felder vom Server überschreiben (nie Client-Werten vertrauen)
input.Type = inputType
input.RoomID = roomID // Server setzt den Raum
input.PlayerID = playerID // Server setzt die Player-ID
bytes, _ := json.Marshal(input)
gw.NC.Publish(fmt.Sprintf("game.room.%s.input", roomID), bytes)