Update lobby API to hide other player's clan tags in public games#3509
Update lobby API to hide other player's clan tags in public games#3509andybellenie wants to merge 2 commits intoopenfrontio:mainfrom
Conversation
WalkthroughUpdated Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/server/GameServer.ts`:
- Around line 667-680: gameInfoForClient leaks clan tags in public lobbies
because rejoinClient/identityUpdate can change a client’s clanTag via censored
input; either stop revealing any clan tags for public games or prevent clanTag
changes after first join. Fix option A: in GameServer.gameInfoForClient(), when
this.gameConfig.gameType === GameType.Public always set each client.clanTag to
null (do not reveal recipient-specific matches). Fix option B: in the
rejoinClient / identityUpdate path, validate that a provided clanTag matches the
already-stored original clanTag (or reject changes) and only update clanTag if
the client has no prior clanTag; ensure censor() is not used to accept arbitrary
new tags. Update the logic in gameInfoForClient and/or rejoinClient accordingly
to reference gameInfoForClient, rejoinClient, identityUpdate, and censor.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e11bd878-a51b-43e5-8750-af4f0dbab7a3
📒 Files selected for processing (1)
src/server/GameServer.ts
Resolves #3496
Description:
Hides the clan tag from the broadcastLobbyInfo() API unless the tag matches your own.
Please complete the following:
Please put your Discord username so you can be contacted if a bug or regression is found:
andystrangelove