a spectator crashed our server

[ilwoody]

So we were hosting a competition, latest condor, latest hangar and having fun with friends, 5 gliders hosting an open server for anyone willing to join. Almost 10 minutes into the race a user called something like wizard' entered the game as a spectator (I presume) and asked if we were interested in his tricks. We replied "no" and well all clients just crashed at the same time, I know because we were in a video conference to communicate. So I don't have any screenshot because I couldn't care less and started a new server with a password and few sec later we had just restarted closer to the point where the game crashed BUT

- come on, this is a game for soaring lover and whoever "wizard" are you, you hitting a small community! there is no need to "flex" you HACK3r skills .. ok you got a vulnerability nice! please report it don't abuse the game, and definitely don't enter the games to annoy people who can't fly together in rl due to the covid situation >.>

- the past 2 releases have been a bit too prone to crashes and you have a clear history of stable releases so the crashes come totally unexpected , we all had to delete our Pilot folder and one of us couldn't see for several minutes into the game all other gliders flying, he could see them just in the navigator screen but not in the 3d view.

Since has been a ton of time since my last visit in this forum I just want to thank you for bringing condor2 to life and for the hard work you put on it (of course its not free so I hope you get enough to make a full time job out of it)

ty

[MarkRebuck]

This sounds exactly like the bug I found/reported in early April, 2018.

...more than two years ago.

A Bad Actor can do something to crash the condor executable for EVERY other pilot on the server. The bug has not been fixed. I just stood up a test server and verified it is still present in 2.1.13.

The email I received from the original bug report was:

Comment from Uros on ticket #16394
The Condorsoaring.com Team <accounts@condorsoaring.com>
Apr 3, 2018, 11:57 AM to mark.rebuck

Condor Support Team

There is a new comment from Uros in the support ticket (Title of ticket redacted because it gives away the exploit -Ed.)

Hello Mark,

thank you for good info. We will investigate it.

Cheers,

Uros

So, Condor developers: If you can access that old ticket, just look at what I wrote there. If not, I can give you details (which I obviously won't post here). The addition of spectator mode makes the exploit worse because there is a degree of anonymity to it.

And for the record: I'm not "wizard". I want as much participation as possible, and do everything I can to keep Bad Actors off my servers.

Cheers,
-Mark Rebuck

[OXO]

We have already identified this, and an update will be coming.