GUI Help

[kingcj]

Ok so don't use params[1] because onActionServerside() references the player that used it, and it's a security risk? Thanks for the help!

[fowlplay4]

Originally Posted by kingcj

Ok so don't use params[1] because onActionServerside() references the player that used it, and it's a security risk? Thanks for the help!

If you're just changing your own player's data, you don't need to pass their account to the server because your player object is accessible.

Scenario: Changing your own player's chat. (Ignore the fact that you can do it on the client-side...)

BAD:

PHP Code:

function onActionServerside() {
  // Potentially allowing hackers to make people laugh uncontrollably.
  with (findplayer(params[1])) {
    player.chat = "haha";
  }
}
//#CLIENTSIDE
function onCreated() {
  // A hacker could change the player.account variable that's being sent.
  triggerserver("gui", this.name, "example", player.account); 
} 


GOOD:

PHP Code:

function onActionServerside() {
  player.chat = "haha";
}
//#CLIENTSIDE
function onCreated() {
  triggerserver("gui", this.name, "example");
}