Arrow buying

[MattKan]

I decided to help further by making you a GUI shopping system in which you can purchase bombs and arrows:

PHP Code:

function onActionServerSide(action) {
  switch (action) {
    case "DecRup":
      player.rupees -= params[1];
    break;
  }
}

//#CLIENTSIDE
function onCreated() {
 new GuiWindowCtrl("Bomb_Window") {
   clientextent = "300,200";
   profile = GuiBlueWindowProfile;
   x = screenwidth/2-150;
   y = screenheight/2-100;
   visible = true;

   text = "Get your bombs and arrows!";
   canmove = true;
   canresize = false;
   canmaximize = false;
 
   new GuiShowImgCtrl("Bomb_Img") {
     x = 55;
     y = 80;
     width = 32;
     height = 32;
     this.image = "bomb.png";
    }
   new GuiShowImgCtrl("Bomb_Img2") {
     x = 210;
     y = 80;
     width = 32;
     height = 32;
     this.image = "arrow.png";
    }
 
   new GuiMLTextCtrl("Bomb_Text") {
     profile = GuiBlueMLTextProfile;
     x = 30;
     y = 35;
     width = 430;     
     height = 50;
     text = "<font size=28><font color=white><b>Bombs:</b></font></font>";
    }
   new GuiMLTextCtrl("Bomb_Text2") {
     profile = GuiBlueMLTextProfile;
     x = 10;
     y = 130;
     width = 430;
     height = 50;
     text = "<font size=13.5><font color=white><b>10 Bombs for 10 Gralats.</b></font></font>";
    }
   new GuiMLTextCtrl("Bomb_Text3") {
     profile = GuiBlueMLTextProfile;
     x = 170;
     y = 35;
     width = 430;
     height = 50;
     text = "<font size=28><font color=white><b>Arrows:</b></font></font>";
    }
   new GuiMLTextCtrl("Bomb_Text4") {
     profile = GuiBlueMLTextProfile;
     x = 160;
     y = 130;
     width = 430;
     height = 50;
     text = "<font size=13.5><font color=white><b>20 Arrows for 10 Gralats.</b></font></font>";
    }
   new GuiButtonCtrl("Bomb_Button1") {
     profile = GuiBlueButtonProfile;
     x = 20;
     y = 155;
     width = 100;
     height = 30;
     text = "Purchase";
    }
   new GuiButtonCtrl("Bomb_Button2") {
     profile = GuiBlueButtonProfile;
     x = 170;
     y = 155;
     width = 100;
     height = 30;
     text = "Purchase";
    }
  }
}

function Bomb_Button1.onAction() {
  //Button "Purchase"
 if (player.rupees >= 9) {
   triggerserver("gui",this.name,"DecRup",10);
   player.bombs += 10;
  }else
    player.chat = "Insufficient Funds";
}

function Bomb_Button2.onAction() {
  //Button "Purchase"
 if (player.rupees >= 9) {
   triggerserver("gui",this.name,"DecRup",10);
   player.darts += 20;
  }else
    player.chat = "Insufficient Funds";
} 


I've also included a .txt file.

[cbk1994]

Originally Posted by MattKan

PHP Code:

function onActionServerSide(action) {
  switch (action) {
    case "DecRup":
      player.rupees -= params[1];
    break; 


This in itself ruins the script. Not only does this allow you to set your own price via Cheat Engine or the like, but you could even set the price to a negative value in order to spawn money.

PHP Code:

function Bomb_Button1.onAction() {
  //Button "Purchase"
 if (player.rupees >= 9) {
   triggerserver("gui",this.name,"DecRup",10);
   player.bombs += 10;
  }else
    player.chat = "Insufficient Funds";
} 


Always do checks like this on serverside. A player could change the amount of darts to gain, the number of rupees to pay, or even negate the trigger entirely. The proper way to do it would be to send a trigger with a parameter "item" (which is either "bomb" or "arrow"), and only add the bombs/arrows on serverside. This ensures that nothing can be tampered with. As a general rule, assume that any script you write on clientside can be changed by a hacker.

An example of how it should be done:

PHP Code:

function onActionServerSide(action, item) { 
  if (action == "purchase") {
    if (! (item in {"bombs", "darts"})) {
      return; // player sent a non-existing item
    }
    
    if (player.rupees < 10) {
      return player.chat = "You need at least 10 rupees!";
    }
    
    player.rupees -= 10;
    
    if (item == "bombs") {
      player.bombs += 10;
    } else if (item == "darts") {
      player.darts += 20;
    }
  }
} 

//#CLIENTSIDE 
// all of the GUI stuff here

function Bomb_Button1.onAction() { 
  triggerServer("gui", this.name, "purchase", "darts");
} 

function Bomb_Button2.onAction() { 
  triggerServer("gui", this.name, "purchase", "bombs");
} 


edit: Tig and Cubical beat me to it, but this should help as well