I made a similar feature request a month ago for the proposed property, I really support something like this as you currently can’t store anything in the character because people can (and do) delete it and break your game.
2 Likes
Does this also affect NPC characters or only players?
1 Like
Found this out the hard way. There was an exploit which deleted a value in the character causing mobs not to deal damage to the player.
Although I patched it, it would be nice to deny the client the ability to delete anything from the character.
3 Likes
Whether or not there should be a feature to disable changes, it seems to me that a
hack/LocalScript should never be able to cause deletion of a Script on the server by deleting the
replicated vestige Script on the client, yet the last time I checked around a month or two ago, it could.
If descendants are also checked for Scripts in this new feature of disallowing Script deletion,
then devs could simply add dummy children Scripts to prevent whatever sensitive hierarchy
in their Character from deletion. (I’d imagine in the interest of compatibility that maybe descendants
of the deepest Scripts could be exempt from this deletion-protection.)
3 Likes
We should have atleast a option to disable this, something like “CharacterRespectFilteringEnabled” in StarterPlayer.
3 Likes
It only works in the Player’s character.
2 Likes
Blessing in disguise?
This could be great for detecting if a client inserts/removes a script from the character. Say a fall damage script which requires local StateType updates, or anything that can’t be done on the server like sending arguments for the mouse position to the server, this can even be used to prevent people from stopping their ragdoll effect since you can detect if joints were removed on the server. I’d argue it’s an effective way to prevent these exploits. That being said, you can easily make the change to place your values inside the player and keep those safe.
1 Like
Bumping this because I’ve ran into unintended/desired behavior with this.
Please add a CharacterRespectFilteringEnabled flag.
This means I can’t store anything in the character, which makes it REALLY hard to program anything securely using humanoids.
Seriously, this sort of character-specific, undefined behavior pushes me closer to making my own characters every day.
9 Likes
I currently use this replication behavior to my advantage by having the server add anti-cheat local scripts and scripts in player characters and kicking a player if I can’t find the script in their character. I also use this to destroy a large number of instances in player characters locally, to reduce the burden on the server (basically creating bullet tracers in player characters and having a local script delete the tracers). I would really hate it if this replication behavior were to be removed, as the way I’m using it allows there to be less lag on the server.
1 Like
I have developer tools in my game that allow specified users to do certain functionalities during testing to simulate what an exploiter would do as well as interface to interact with player data, this includes the ability to delete parts. I am finding that when someone deletes an NPCs head, that NPC ends up dying despite the deletion of the head happening locally. The server recognises that said health of the Humanoid is also 0. This of course is very bad.
Could this be a result of the unintended/desired behavior you are experiencing?
1 Like
I rely on this replication behavior to reduce the load on the server by deleting instances inside player characters with LocalScripts and having a timed deletion in a server Script using the Debris service in case the player doesn’t delete the instance when they are supposed to. This replication behavior is incredibly convenient (speaking as a developer who had a hard time converting from Experimental Mode). Personally, if I didn’t want something in a character to be deleted, I would use signals server-side to make sure to respawn players if they remove anything important (DescendantRemoving/ChildRemoved/AncestryChanged).
1 Like
In my roleplay game, some exploiters are deleting their shirt / pants instances to walk around without clothes on, which doesn’t look very appropriate. Furthermore, some of them are going “limbless” by deleting their arms/legs.
There should be a CharacterRespectFilteringEnabled flag. This would also allow me to not waste time with programming server detection on things like this.
WE need more attention on FilteringEnabled, especially on things that we can prevent super easily!
13 Likes
Just ran into this same behavior. I was locally deleting a weld on the client as part of a client-prediction system for my game, only to find out it’s screwing with the game’s state on the server. This is a serious security hole - any code that relies on avatars not being completely broken could potentially be broken by an exploiter.
5 Likes
Ultra-bump.
PLEASE fix this. It’s really difficult to create anticheats aginst this. Currently, my players can even remove server-scripts from their character.
9 Likes
PLEASE fix this issue. This bug is affecting gameplay.
5 Likes
This should be a high priority to fix this extremely security-invading issue. We need more spotlight on these core vulnerabilities rather than introducing newer and newer features.
It could have ended badly if I haven’t found out this problem on my own.
BUMP
4 Likes
Uhhh, do you have any data to prove that? This sounds like nonsense.
The server will have to destroy the instances by itself anyway, regardless of which side initiated the action.
You can’t magically use the client’s computing power to do stuff on the server.
1 Like
This is now resolved with the RejectCharacterDeletions property:
2 Likes
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.