Admin security

[JamesCaeser]

1. function checkClient(checkAccess,player,...)
2.     if client and client ~= player and g_Prefs.securitylevel >= 2 then
3.         local desc = table.concat({...}," ")
4.         local ipAddress = getPlayerIP(client)
5.         outputDebugString( "Admin security - Client/player mismatch from " .. tostring(ipAddress) .. " (" .. tostring(desc) .. ")", 1 )
6.         cancelEvent()
7.         if g_Prefs.clientcheckban then
8.             local reason = "admin checkClient (" .. tostring(desc) .. ")"
9.             addBan ( ipAddress, nil, nil, getRootElement(), reason )
10.         end
11.         return true
12.     end
13.     if checkAccess and g_Prefs.securitylevel >= 1 then
14.         if type(checkAccess) == 'string' then
15.             if hasObjectPermissionTo ( player, checkAccess ) then
16.                 return false    -- Access ok
17.             end
18.             if hasObjectPermissionTo ( player, "general.adminpanel" ) then
19.                 outputDebugString( "Admin security - Client does not have required rights ("..checkAccess.."). " .. tostring(ipAddress) .. " (" .. tostring(desc) .. ")" )
20.                 return true        -- Low risk fail - Can't do specific command, but has access to admin panel
21.             end
22.         end
23.         if not hasObjectPermissionTo ( player, "general.adminpanel" ) then
24.             local desc = table.concat({...}," ")
25.             local ipAddress = getPlayerIP(client or player)
26.             outputDebugString( "Admin security - Client without admin panel rights trigged an admin panel event. " .. tostring(ipAddress) .. " (" .. tostring(desc) .. ")", 2 )
27.             return true            -- High risk fail - No access to admin panel
28.         end
29.     end
30.     return false
31. end

Errors:

ERROR: adminp\server\admin_server.lua:1416: Admin security - Client/player mismatch from **.**.***.** (onElementDataChange isAmeShowing) 
ERROR: adminp\server\admin_server.lua:1416: Admin security - Client/player mismatch from **.**.***.** (onElementDataChange isAdoshowing)

Help me, please

Edited May 31, 2017 by JamesCaeser

[Hale]

Could you please provide more information? When is this function being called, what is g_Prefs.securitylevel and what is the purpose of this function?

[JamesCaeser]

This error occurs when write in chat say /ame ..... The error itself comes from admin-panel

[Investor]

 

ERROR: adminp\server\admin_server.lua:1416: Admin security - Client/player mismatch from **.**.***.** (onElementDataChange isAmeShowing) 
ERROR: adminp\server\admin_server.lua:1416: Admin security - Client/player mismatch from **.**.***.** (onElementDataChange isAdoshowing)

These errors are a part of admin panel's anticheat system. The code prevents one client from messing with another player's element data, and the IP shown in the error is the IP of the client attempting to modify someone else's data. All you need to do is change how your code edits isAmeShowing or isAdoshowing data, to do it by client who you're changing or instructing the server to do that.

[JamesCaeser]

idk, can u help me?

this file: https://yadi.sk/d/DiQCsNB63Jh8eL

[idarrr]

The problem is on client side code. You are trying to set an element data for another player on client side.

[Hale]

Either remove that anti-cheat protection or find a way to update element data via server side (triggerServerEvent)

[Addlibs]

If you want to disable this security feature, go into the admin panel, resources tab, double click "adminp" in the list, then set the "securitylevel" settings to 1, or maybe even 0 - as long as its lower than 2, then restart adminp.

However, this can expose you to the risk of someone modifying other people's element data so I advise you not to do that.

[Hale]

2 hours ago, MrTasty said:

However, this can expose you to the risk of someone modifying other people's element data so I advise you not to do that.

How is that possible nowadays, didn't MTA create its own anti cheat/trainer system?

Edited June 1, 2017 by Hale

[Addlibs]

9 minutes ago, Hale said:

How is that possible nowadays, didn't MTA create its own anti cheat/trainer system?

Maybe, but its better not to take chances, imo.