Client has influence on server-network-owned parts

In a certain setup, a client can change the velocity of parts that: are network-owned by the server and are in a Collision group that does not collide with the players’ Collision group. The player can’t touch them, nor get network ownership of them, and therefore shouldn’t influence them at all.

Setup:

Create a Collision group that is different from Default. Make this Collision group not collide with Default.
Create a Part in the workspace, and set the CollisionGroup to the newly created one.
(For demonstrative purposes: add a Force equivalent to the gravity force on the part, so that the part does not fall and stay in the air.)
Give the Player a Tool, with a Handle that is big enough to touch the Part. The Handle should have CanCollide and CanTouch set to true (the default). The Handle needs to have a TouchInterest, so add a script that listens to the Handle’s Touched event.
Create an Anchored part, and put it as a wall next to the floating Part.
Enter playing mode, hold the tool, and jump against the wall (holding the tool through the wall). Make sure the tool’s Handle will hit the floating part. After some tries, this will cause the part to start floating downwards; this means the client has had influence on the server-owned part.

Video

YouTube video of the bug

File

bugreport.rbxl (82.4 KB)

Expected behavior

I expect the server-owned, uncollidable parts to not be influenced at all by the player.

3 Likes

Hi, this is indeed a bug, great find!

The issue stems from incorrect collision filtering for parts with a TouchInterest attached to them. Fix should go live in a few weeks.

3 Likes