#129385: "It is possible to see other players' destinations by inspecting the websocket connection"
Με τι σχετίζεται αύτη η αναφορά;
Τι συνέβη; Επιλέξτε από τα παρακάτω
Λεπτομερής περιγραφή
• Ποιο μέρος των κανόνων δεν έγινε σεβαστό από την μετατροπή του παιχνιδιού για την BGA
Each player's destinations should only be made known to them.• Είναι η παραβίαση των κανόνων ορατή στην αναπαραγωγή του παιχνιδιού; Αν ναι, σε ποια κίνηση;
It is visible on game replay, and also visible when playing a new game.
How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.
Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.• Ποιο είναι το πρόγραμμα περιήγησής σου;
Google Chrome v126
Ιστορικό αναφορών
Πρόσθεσε κάτι σε αυτήν την αναφορά
- Άλλο ID τραπεζιού/ ID κίνησης
- Το F5 έλυσε το πρόβλημα;
- Το πρόβλημα εμφανιζόταν αρκετές φορες;Παντού ; Τυχαία;
- Αν έχεις απόσπασμα οθόνης από αυτό το σφάλμα (είναι καλή αυτή η πρακτική), μπορείς να χρησιμοποιήσεις το Imgur.com για να το ανεβάσεις και να κάνεις αντιγραφή/επικόλληση του συνδέσμου εδώ.