Graal Forums - Events System

Graal Forums (https://forums.graalonline.com/forums/index.php)

- Code Gallery (https://forums.graalonline.com/forums/forumdisplay.php?f=179)

- - Events System (https://forums.graalonline.com/forums/showthread.php?t=134264180)

Every UC server I've been on to seems to want an events system of their own without a lot of hassle involved in developing it. My main purpose in this task was to make it as simple as possible for everyone to use. Well, this is what I have created:
An events system that is handled solely by one weapon which has to be added to every player when they log in. Not only does this system handle hosting of events, it handles warping players, kicking players, adding EC to players, and pretty much everything you'd expect out of an events system.
To make sure no-one goes into observer mode and disrupts gameplay for other players, players using a trial account cannot join events.
It also prevents events team members stealing EC, and prevents players setting nicks or issuing commands in events that start with "/".
It's also very flexible, and takes the event names from the level name itself.
Give it a go and see what you make of it.
There are a few commands, both events team and players will need to know, and they are included in the instructions.txt file at the bottom of this post, as well as a few pointers for events developers creating events with this system.

The only few things you need to do are:

- Save the script into a weapon with a name starting with "-".

- Set up an EC database so that EC can be stored by doing the following:

1. Opening up NPCs list.
2. Creating a new object NPC named EC_Database.

- Create a text file called "ec_log.txt" so that EC giveouts can be logged.

- Change the 4 constant variables in the script (which are just under the
clientside marker) to suit your server.
Also, just to spice it up, I created a simple image to make the event
masses look just a bit more appealing, so download that too.
Name it "kavan_eventcoin.png" unless you want to root through the script
and change the showimg. (index 3004)

Here's a screenshot of this in action:

http://i52.tinypic.com/s0vh2c.png

I hope you enjoy this. Please post any bugs/feedback/problems that you have and I will do my best to help you.

Nice, I'll enjoy messing with this ;)
I also like the idea of EC in a DB.

Nice man! This looks fantastic (=.
I hope you keep updating this, like you did with your Admin GUI tool.

Also, for those servers that have a mass system right there at the bottom left of your screen. There's a solution I've found.
Replace lines 167 - 184 with this:

PHP Code:


		
			
 showPoly(3000, {ScreenWidth - 200,(GraalControl.height-30)-(temp.h*2),
                 ScreenWidth - 200+temp.w+40,(GraalControl.height-30)-(temp.h*2),
                 ScreenWidth - 200+temp.w+40,(GraalControl.height-30)+temp.h+2,
                 ScreenWidth - 200,(GraalControl.height-30)+temp.h+2});
 changeImgColors(3000,1,1,0,.99);
 changeImgVis(3000,5);
 
 showText(3001,ScreenWidth - 163,(GraalControl.height-29)-(temp.h*2),"Arial","b","Event: "@event);
 changeImgZoom(3001,.8);
 changeImgVis(3001,6);
 showText(3002,ScreenWidth - 163,(GraalControl.height-29)-temp.h,"Arial","b","EC: "@ec);
 changeImgZoom(3002,.8);
 changeImgVis(3002,6);
 showText(3003,ScreenWidth - 163,(GraalControl.height-29),"Arial","b","Click to play!"@msg);
 changeImgZoom(3003,.8);
 changeImgVis(3003,6);
 showImg(3004,"kavan_eventcoin.png",ScreenWidth - 196,(GraalControl.height-52));
 changeImgVis(3004,6);

The problem with that is you don't know the limit of the mass messaging system, so the messages could go the whole way up the side of the screen and go right through the events mass message.
You're best just putting the mass message output above the point where the event mass appears.

The first thing I noticed: you're using one space to indent instead of two. I give you points for at least being consistent, but doing this just makes it a pain for others to work with your scripts. Everybody else on Graal uses two spaces.

The second thing I noticed: you're not doing any checks serverside, which means that a 'hacker' can easily give out EC or host their own events or warp themselves anywhere.

The key to writing secure scripts is to assume that everything you write on clientside can be edited by a player (because it can be, to an extent).

For example, you should store the event warper location on serverside (probably as a database NPC flag or a server. flag).

Then, instead of this:

PHP Code:


		
			
if(params[0] == "WarpPlayer"){

 player.setLevel2(params[1],params[2][0],params[2][1]);

 player.guild = "";

}

do this:

PHP Code:


		
			
if(params[0] == "WarpPlayer"){

 player.setLevel2(EventDB.warpLevel, EventDB.warpPos[0], EventDB.warpPos[1]);

 player.guild = "";

}

Any kid with Cheat Engine could use the first block of code to warp to any level on your server since you're trusting that the client's input is what it should be. Never trust user input.

The same goes for the leave trigger. Why accept the player's values when they're constants that you could have just defined on serverside?

On a related note, you should verify that the player is actually wearing the proper staff tag on serverside before allowing them to host or give EC.

PHP Code:


		
			
 if(params[0] == "GiveEC"){

  if(findPlayer(params[1]).account != NULL){

   if(findPlayer(params[1]).account != player.account){

    EC_Database.(@params[1]) += params[2];

With the above code, all I'd have to do is search with Cheat Engine for a command that I can easily trigger, such as "WarpPlayer", replace it with "GiveEC", replace the event level with a friend's account, optionally change the number of EC, and click to warp, which would actually send a "GiveEC" trigger.

The proper way to implement that feature would be to check that the player is, in fact, on the proper tag first and is allowed to give EC. It's only a couple extra lines of code to fix. This is also an issue with kicking, etc.

The "max EC" limit should also be implemented serverside, since I could use the same technique to avoid that.

Instead of re-using the params array, you could at least use variables so other scripters can see what they actually are.

It's also better to just call findplayer once and store the 'found player' in a variable and use it instead of constantly calling findplayer every time you want to access the player's object.

I.e:

PHP Code:


		
			
function onActionServerSide() {

  // other code..

  if (params[0] == "GiveEC") {

    temp.target = findplayer(params[1]);

    temp.ec_amount = params[2];

    if (temp.target != NULL) {

      if (temp.target != player) {

        EC_Database.(@temp.target.account) += params[2];

        EC_Database.trigger("update");

        temp.msg = player.communityname SPC "gave " @ temp.ec_amount SPC "EC to " @ temp.target.communityname SPC "(" @ temp.target.account @ ")";

        sendToRc(temp.msg);

        saveLog2("ec_log.txt", temp.msg);

        player.chat = "Gave " @ temp.ec_amount SPC "EC!";

        temp.target.chat = "Gained " @ temp.ec_amount SPC "EC!";

      } else {

        sendToRC(player.communityname SPC "tried to take EC while hosting an event.");

        player.chat = "Now, now.. You shouldn't be stealing EC...";

      }

    } else {

      player.chat = "Player doesn't exist...";

    }

  }

  // other code..

}

Serverside security is also very important so make sure you follow cbk's advice and fix that too.

Your 'Join Event' GUI could use some work still as well.

Who came up with this Cheat Engine? The more I read about, the more ingenious the whole thing sounds.

But yeah, I'll take into consideration what you and Chris are saying and hopefully improve on this script's security, but god, do these people with Cheat Engines make scripting a total pain in the ass... !pissed!
Also, when you say the GUI could use some work, are you implying that it's faulty or just that I could improve the overall appearance of it?

Quote:

Originally Posted by iBeatz (Post 1663164)

Who came up with this Cheat Engine? The more I read about, the more ingenious the whole thing sounds.

Its not just cheat engine, its any memory editor, really.
You always need to cheat-proof your scripts. Thats a basic for any scripting language. If your script or program can be easily hacked or changed on the fly, then thats on you to change.

It's easier just to separate the tools from the front-end.

Instead packaging it altogether in one weapon, make a front-end (Event GUI) and a staff tool (EC Awarder) that allows you to add EC and just give that to your staff members instead.

You'll still have to do the same server-side checks to prevent unauthorized people from using them though.

As for the GUI I was just talking about the appearance.

How to install, I'm a bit confused and wanted to check it out, I put the script as -Events_System in the scripts section of RC. I then added it to my character. I tried the commands but it didn't work. I don't know much about scripting, so can you please be just a little bit more clearer? Thanks!

Quote:

Originally Posted by patrickp2p (Post 1663394)

Did you have an Events Team tag on?

Nice job :)

I'm sure lots of people will appreciate this.