The console feature allows users with the 'console' permission
to execute arbitrary JavaScript in the context of the server
process. This allows for the execution of arbitrary code on the
local computer running the Pokemon Showdown server. As such,
the console permission is different from all other permissions
in that it gives power over more than just Pokemon Showdown.
It is likely that most users do not realise how powerful the
console permission is. As such, this commit alters the 'root'
permission so that it does not include the 'console' permission.
If a user intends to give a usergroup the console permission,
the server operator must add
console: true
to a usergroup's permissions in config.js.
This implementation also has the effect of disabling the
console feature on all current servers that pull this commit,
unless they explicitly enable it for a usergroup.
Please do not enable the console permission unless you fully
understand how powerful it is.
It is not actually necessary to resend the request if the rqid
is wrong because the player will have received the request after
sending in the move, so the client will still be in the move
selection phase.
The following sequence of events was causing a crash:
1) User sends in decision to server (with the wrong rqid specified).
2) Server receives decision and sends message M to simulator process.
3) User leaves battle and sends the server a message to inform of this.
4) Server removes the user from his or her battle in the main process,
which sets the user's entry in simulator.player to null.
5) The simulator process processes message M and, since the rqid in
the decision is wrong, send a resendrequest message back to the
main process.
6) The main process in resendRequest() tries to access properties of
the player, which are now null as of event (4), causing a crash.
This commit fixes the problem by making sure that user is not null
before accessing its properties.
Previously, Simulator.prototype.resendRequest() called user.sendTo()
with an invalid room specified, causing the server to send the
message to all rooms, leading to problems on the live server.
This refactored version checks the rqid as part of the decision
data, rather than introducing a new /ackrequest command. This
change is done in a backward-compatible way.
Most of the code does not change compared to the previous version.
The corresponding client commit is Zarel/Pokemon-Showdown-Client@3b82cf5cec
In certain laggy situations, the following sequence of events
was previously possible in a battle:
1) Server makes request R_1 and R_2.
2) User 1 selects decision D_1 for request R_1
3) User 2 selects decision D_2 for request R_2
4) Server receives D_1 and D_2 and runs the turn
5) Server makes request R_3 and R_4.
4) Due to lag, User 1 does not realise that the server has
already run the turn. User 1 wants to change his or her move
for request R_1, so User 1 cancels decision D_1 and sends in
decision D_3, intending it to be for request R_1.
5) User 2 selects decision D_4 for R_4.
6) Server receives D_3 and considers it to be the response to R_3,
rather than the response to R_1 (which was what User 1 intended).
7) Server receives D_4 and considers it to be the response to R_4.
8) Server runs the turn.
The result of this sequence of events is that a move that User 1
intended to be for request R_1 is instead used for R_3, which has
the effect of depriving the user of the ability to make a reasoned
choice of which move to use for R_3.
This commit attempts to solve this problem by requiring the client
to acknowledge having received a request before the server will
accept a decision for that request.
Unfortunately, there is no seamless way to implement this in a
backward-compatible way. In other words, if the client were updated
to always send acks, it would no longer be able to work with old
versions of the server. For example, if the ack were added to the
choice string, old servers would no longer be able to handle choice
strings sent from the client. Similarly, if the ack were added
in the form of a new command (say, /ackrequest), old servers would
emit an unrecognised command error on receiving the command.
This commit maintains backward-compatibility by introducing a version
field to the init data structure sent to the client when joining a
battle room. This version should be incremented for any future
backward-incompatible changes as well.
The implementation of the ack request system is that the client must
send in "/ackrequest rqid" for each request, where rqid is the ID of
the request. If the server has not received an ack for request 'rqid'
when it receives a decision for request 'rqid', it discards the
decision and asks the client for another decision.
The corresponding client commit is Zarel/Pokemon-Showdown-Client@ccf0a97733
- Random battles and automatic detection sets Hidden Power IVs correctly
- Hidden Power now always does damage based on user's IVs
- User's Hidden Power base power is now reported
The default configuration of Pokemon Showdown does not use
socket.io, so it is more appropriately marked as an optional
dependency. This change is largely cosmetic because npm install
will still install optionalDependencies.
The 'request' module is currently unused so it doesn't need to
be included in package.json.
In addition, GitHub is now served over SSL (and has been for
a while).
