From 68f767e728e5856599bbd62846e1d5b58ee1c12b Mon Sep 17 00:00:00 2001
From: Glease <4586901+Glease@users.noreply.github.com>
Date: Wed, 2 Aug 2023 17:43:30 +0800
Subject: [PATCH] validate player has the prereq self infusion before doing
 what player has requested (#54)

---
 .../lib/networking/PacketFingersToServer.java |  3 ++
 .../common/lib/networking/PacketHandler.java  | 32 +++++++++++++++++++
 .../networking/PacketToggleClimbToServer.java |  3 ++
 .../PacketToggleInvisibleToServer.java        | 17 +++++-----
 4 files changed, 47 insertions(+), 8 deletions(-)

diff --git a/src/main/java/com/kentington/thaumichorizons/common/lib/networking/PacketFingersToServer.java b/src/main/java/com/kentington/thaumichorizons/common/lib/networking/PacketFingersToServer.java
index 7798fad..9e3653f 100644
--- a/src/main/java/com/kentington/thaumichorizons/common/lib/networking/PacketFingersToServer.java
+++ b/src/main/java/com/kentington/thaumichorizons/common/lib/networking/PacketFingersToServer.java
@@ -38,6 +38,9 @@ public class PacketFingersToServer implements IMessage, IMessageHandler<PacketFi
     }
 
     public IMessage onMessage(final PacketFingersToServer message, final MessageContext ctx) {
+        if (!PacketHandler.selfInfusionSecurityCheck(ctx, "open workbench", message.playerid, 2)) {
+            return null;
+        }
         final World world = DimensionManager.getWorld(message.dim);
         final EntityPlayer player = (EntityPlayer) world.getEntityByID(message.playerid);
         player.openGui(
diff --git a/src/main/java/com/kentington/thaumichorizons/common/lib/networking/PacketHandler.java b/src/main/java/com/kentington/thaumichorizons/common/lib/networking/PacketHandler.java
index bb86129..4369eea 100644
--- a/src/main/java/com/kentington/thaumichorizons/common/lib/networking/PacketHandler.java
+++ b/src/main/java/com/kentington/thaumichorizons/common/lib/networking/PacketHandler.java
@@ -4,13 +4,23 @@
 
 package com.kentington.thaumichorizons.common.lib.networking;
 
+import net.minecraft.entity.player.EntityPlayerMP;
+
+import org.apache.logging.log4j.Marker;
+import org.apache.logging.log4j.MarkerManager;
+
+import com.kentington.thaumichorizons.common.ThaumicHorizons;
+import com.kentington.thaumichorizons.common.lib.EntityInfusionProperties;
+
 import cpw.mods.fml.common.network.NetworkRegistry;
+import cpw.mods.fml.common.network.simpleimpl.MessageContext;
 import cpw.mods.fml.common.network.simpleimpl.SimpleNetworkWrapper;
 import cpw.mods.fml.relauncher.Side;
 
 public class PacketHandler {
 
     public static final SimpleNetworkWrapper INSTANCE;
+    private static final Marker SECURITY_MARKER = MarkerManager.getMarker("SuspiciousPackets");
 
     public static void init() {
         int idx = 0;
@@ -49,4 +59,26 @@ public class PacketHandler {
     static {
         INSTANCE = NetworkRegistry.INSTANCE.newSimpleChannel("ThaumicHorizons".toLowerCase());
     }
+
+    private static void securityWarn(String message, Object... args) {
+        ThaumicHorizons.log.warn(SECURITY_MARKER, message, args);
+    }
+
+    static boolean selfInfusionSecurityCheck(final MessageContext ctx, String action, int sentPlayerID,
+            int requiredInfusion) {
+        final EntityPlayerMP player = ctx.getServerHandler().playerEntity;
+        if (player.getEntityId() != sentPlayerID) {
+            PacketHandler.securityWarn("Player {} tried to {} for other people!", player.getGameProfile(), action);
+            return false;
+        }
+        EntityInfusionProperties ieep = (EntityInfusionProperties) player.getExtendedProperties("CreatureInfusion");
+        if (!ieep.hasInfusion(requiredInfusion)) {
+            PacketHandler.securityWarn(
+                    "Player {} tried to {} getting the ability legitimately",
+                    player.getGameProfile(),
+                    action);
+            return false;
+        }
+        return true;
+    }
 }
diff --git a/src/main/java/com/kentington/thaumichorizons/common/lib/networking/PacketToggleClimbToServer.java b/src/main/java/com/kentington/thaumichorizons/common/lib/networking/PacketToggleClimbToServer.java
index b2f654a..f9d78a3 100644
--- a/src/main/java/com/kentington/thaumichorizons/common/lib/networking/PacketToggleClimbToServer.java
+++ b/src/main/java/com/kentington/thaumichorizons/common/lib/networking/PacketToggleClimbToServer.java
@@ -38,6 +38,9 @@ public class PacketToggleClimbToServer implements IMessage, IMessageHandler<Pack
     }
 
     public IMessage onMessage(final PacketToggleClimbToServer message, final MessageContext ctx) {
+        if (!PacketHandler.selfInfusionSecurityCheck(ctx, "toggle spider climb", message.playerid, 9)) {
+            return null;
+        }
         final World world = DimensionManager.getWorld(message.dim);
         final EntityPlayer player = (EntityPlayer) world.getEntityByID(message.playerid);
         ((EntityInfusionProperties) player
diff --git a/src/main/java/com/kentington/thaumichorizons/common/lib/networking/PacketToggleInvisibleToServer.java b/src/main/java/com/kentington/thaumichorizons/common/lib/networking/PacketToggleInvisibleToServer.java
index 15b9de4..15b07b4 100644
--- a/src/main/java/com/kentington/thaumichorizons/common/lib/networking/PacketToggleInvisibleToServer.java
+++ b/src/main/java/com/kentington/thaumichorizons/common/lib/networking/PacketToggleInvisibleToServer.java
@@ -7,10 +7,9 @@ package com.kentington.thaumichorizons.common.lib.networking;
 import java.util.ArrayList;
 
 import net.minecraft.entity.player.EntityPlayer;
+import net.minecraft.entity.player.EntityPlayerMP;
 import net.minecraft.potion.Potion;
 import net.minecraft.potion.PotionEffect;
-import net.minecraft.world.World;
-import net.minecraftforge.common.DimensionManager;
 
 import com.kentington.thaumichorizons.common.lib.EntityInfusionProperties;
 
@@ -43,12 +42,14 @@ public class PacketToggleInvisibleToServer
     }
 
     public IMessage onMessage(final PacketToggleInvisibleToServer message, final MessageContext ctx) {
-        final World world = DimensionManager.getWorld(message.dim);
-        final EntityPlayer player = (EntityPlayer) world.getEntityByID(message.playerid);
-        ((EntityInfusionProperties) player
-                .getExtendedProperties("CreatureInfusion")).toggleInvisible = !((EntityInfusionProperties) player
-                        .getExtendedProperties("CreatureInfusion")).toggleInvisible;
-        if (((EntityInfusionProperties) player.getExtendedProperties("CreatureInfusion")).toggleInvisible) {
+        if (!PacketHandler
+                .selfInfusionSecurityCheck(ctx, "toggle chamelon skin (i.e. invisible)", message.playerid, 10)) {
+            return null;
+        }
+        final EntityPlayerMP player = ctx.getServerHandler().playerEntity;
+        EntityInfusionProperties ieep = (EntityInfusionProperties) player.getExtendedProperties("CreatureInfusion");
+        ieep.toggleInvisible = !ieep.toggleInvisible;
+        if (ieep.toggleInvisible) {
             player.removePotionEffect(Potion.invisibility.id);
             player.setInvisible(false);
         } else {