From 807a806a0dd95709fd4146a393ad28cfe90b97c7 Mon Sep 17 00:00:00 2001 From: MagicBot Date: Tue, 27 Oct 2026 21:50:31 -0400 Subject: [PATCH] Check building access on every vendor production action ItemProductionMsgHandler trusted the client to send production, recycle, junk, deposit, price and take requests only from an open management window. It now applies the window's own rule (owner, guild leader or IC, or building friends) before any action. Value changes: none for players who can open the window; others are silently ignored. Co-Authored-By: Claude Opus 5.5 --- .../net/client/handlers/ItemProductionMsgHandler.java | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/engine/net/client/handlers/ItemProductionMsgHandler.java b/src/engine/net/client/handlers/ItemProductionMsgHandler.java index de628afe..2489f991 100644 --- a/src/engine/net/client/handlers/ItemProductionMsgHandler.java +++ b/src/engine/net/client/handlers/ItemProductionMsgHandler.java @@ -62,6 +62,12 @@ public class ItemProductionMsgHandler extends AbstractClientMsgHandler { if (vendor == null) return true; + // Same access rule as opening the vendor's management window (OrderNPCMsgHandler); never trust the client + + if (!BuildingManager.PlayerCanControlNotOwner(vendor.getBuilding(), player) + && !BuildingManager.playerCanManage(player, vendor.getBuilding())) + return true; + // Process Request switch (msg.actionType) {