From 31743d9fa138ace694b3b09a524c197d0e1a9d56 Mon Sep 17 00:00:00 2001 From: Aaron Kimbrell Date: Tue, 10 Nov 2026 16:14:25 -0600 Subject: [PATCH] doc: README: the checks on what clients and servers send, merged from the fix branch Co-Authored-By: Claude Fable 5.2 --- README.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/README.md b/README.md index b79f88177..795091d32 100644 --- a/README.md +++ b/README.md @@ -156,6 +156,16 @@ locally. See [docs/UgcServer.md](docs/UgcServer.md). with a log line. Servers build `blocklist.dcf` from a plain `blocklist.txt` next to them, and blocked entries can be phrases. See "Block list file" in [docs/Dashboard.md](docs/Dashboard.md). * The chat server's old web API is removed; the dashboard's API covers online players, teams and announcements. +* **Checks on what clients and servers send (merged 2026-11-10 from a fix branch for `main`):** session keys are 16 + bytes from the system entropy source, sent as 32 hex characters and passed between the auth, master and world servers + as a string; the chat server listens with the password the servers share; a world server only routes the chat + messages a client sends. A trade offer is checked against the items the player holds and against what the client's + trade window takes (8 items, none bound, equipped, undeletable or an unapproved model), and a changed offer takes + both accepts back. Vendor counts and prices, mission dialogues, level ups, property changes and a player's own + messages are checked against the player that sent them; lengths read from a message have to fit in it, and sd0 and + AMF3 data have limits. The master server only starts instances of zones in the ZoneTable and at most + `max_instances` (masterconfig.ini, 256 by default, 0 for no limit); a player whose zone gets no instance is told + that the map change failed. ## License Darkflame Universe is licensed under AGPLv3, please read [LICENSE](LICENSE). Some important points: