Fortify: Simultaneous deploy. Cheating possible

[severgun]

Arma 3 Version: 1.94 (stable)
CBA Version: 3.11.1 (stable)
ACE3 Version: 3.12.6 (stable)
ACEX Version: 3.4.2 (stable)

Mods:

- CBA_A3
- ace
- acex

Description:

• It is hard to reproduce but... Simultaneous deploy can lead to -1 in budget and unlock infinite building capability.
  

  ACEX/addons/fortify/functions/fnc_updateBudget.sqf

  Lines 26 to 27 in 75ce0f6

  	private _budget = [_side] call FUNC(getBudget);
  	private _newBudget = _budget + _change;

  
  Would be nice to have result of sum limited by 0.

Steps to reproduce:

• Set cost and budget
  [west, 7, [["Land_TentA_F", 5],["Land_SandbagBarricade_01_half_F", 3]]] call acex_fortify_fnc_registerObjects;
• Try to build 2 objects simultaneously.

Where did the issue occur?

• Dedicated / Self-Hosted Multiplayer / Editor (Multiplayer)

[PabstMirror]

I remember that the spending wasn't "thread safe", but I think we figured that a random double spend wouldn't be a big deal
but obviously getting it to -1 is 😄

the real fix would be doing all spending on the server, with proper event passing to ensure that the var is only updated from a single source

[severgun]

What if you have 10 players with fortify tool? Will it discard building or hold payments?
Actually we have modified version of acex with progress bar and because of my mistake we got easy reproducible breach and players were happy to use it