Browse Source

* Fixed zeny duplication exploit in mail system, introduced in r15310.
* Added proper mail zeny loss prevention (bugreport:2919, follow-up to r15310).

git-svn-id: https://svn.code.sf.net/p/rathena/svn/trunk@15520 54d463be-8e91-2dee-dedb-b68131a5f0ec

gepard1984 13 years ago
parent
commit
ada41eebd1
2 changed files with 5 additions and 3 deletions
  1. 4 1
      src/map/clif.c
  2. 1 2
      src/map/mail.c

+ 4 - 1
src/map/clif.c

@@ -13687,8 +13687,11 @@ void clif_parse_Mail_getattach(int fd, struct map_session_data *sd)
 	if( sd->mail.inbox.msg[i].zeny < 1 && (sd->mail.inbox.msg[i].item.nameid < 1 || sd->mail.inbox.msg[i].item.amount < 1) )
 	if( sd->mail.inbox.msg[i].zeny < 1 && (sd->mail.inbox.msg[i].item.nameid < 1 || sd->mail.inbox.msg[i].item.amount < 1) )
 		return;
 		return;
 
 
-	if( ( sd->mail.inbox.msg[i].zeny + sd->mail.inbox.msg[i].zeny ) > MAX_ZENY )
+	if( sd->mail.inbox.msg[i].zeny + sd->status.zeny > MAX_ZENY )
+	{
+		clif_Mail_getattachment(fd, 1);
 		return;
 		return;
+	}
 	
 	
 	if( sd->mail.inbox.msg[i].item.nameid > 0 )
 	if( sd->mail.inbox.msg[i].item.nameid > 0 )
 	{
 	{

+ 1 - 2
src/map/mail.c

@@ -46,8 +46,7 @@ int mail_removeitem(struct map_session_data *sd, short flag)
 int mail_removezeny(struct map_session_data *sd, short flag)
 int mail_removezeny(struct map_session_data *sd, short flag)
 {
 {
 	nullpo_ret(sd);
 	nullpo_ret(sd);
-	if( ( sd->status.zeny + sd->mail.zeny ) > MAX_ZENY )
-		return 1;
+
 	if (flag && sd->mail.zeny > 0)
 	if (flag && sd->mail.zeny > 0)
 	{  //Zeny send
 	{  //Zeny send
 		log_zeny(sd, LOG_TYPE_MAIL, sd, -sd->mail.zeny);
 		log_zeny(sd, LOG_TYPE_MAIL, sd, -sd->mail.zeny);