local module = require(game.workspace.Module)
local RE = game.ReplicatedStorage.RemoteEvent
local value = module.Numbers[1] -- 1
RE:FireClient(player, value)
in this scenario does ‘value’ in the second argument being passed to the client translate to passing;
require(game.workspace.Module.Numbers[1])
or does it translate to just passing “1”? I want to pass this variable but want to be 100% positive it doesn’t mean the client gets to ‘acquire’ the entire module for exploitation reasons. Naturally it’ll just print “1” correctly but I want to make sure the module packet isn’t entirely received consequently as a result of getting that variable sourced from there.
Not exactly sure what you mean, so here’s some general info:
The server and client each get their “own copy” of the module, much like almost everything else in roblox. Storing safe values in a module script in replicated storage is unsafe since the client has access to everything in replicated storage. If you’re storing the values in the server’s copy then it’s okay though.
Here’s an example:
Module
local Module = {}
Module.Value = 25
return Module
Server
local ReplicatedStorage = game:GetService("ReplicatedStorage")
local Module = require(ReplicatedStorage:FindFirstChild("Module"))
Module.Value = 1
print(Module.Value) -- 1
Client
local ReplicatedStorage = game:GetService("ReplicatedStorage")
local Module = require(ReplicatedStorage:FindFirstChild("Module"))
task.wait(5)
print(Module.Value) -- Still 25, cannot read server values
Mainly I want to see if passing a variable sourced from a module script results in the client being able to see in the module and gain info from it via exploiting. (module is placed in workspace)
In my example I don’t know if I’m passing ‘1’ or if im passing ‘the entire path including the module to reach that variable’.
like am I sending:
RE:FireClient(player, 1)
or
RE:FireClient(player, acquire(game.workspace.Module.Numbers[1]) -- client acquired module, now they know everything their opponent has
The reason I’m set up like this is I have the client handle all the visuals, them and their opponent are in a turn based match and play units on tiles. The client visually grabs and moves stuff, then sends to the server what action they’re trying and if it makes sense (not a tile occupied already), the server then sends info back both player’s clients to visually reflect the change for them respectively since POVs may be different. If the module was client visible, an exploiter would be able to see everything their opponent is obstructing (like all units they have available which is visually local to them only) so I want to make sure if the module holds a unit’s health, and the server sends that health over to the client to visually update their ui, it doesn’t mean that client can pull all information from that packet to see the rest of the module.
Its not visually handled server sided cause plan is the same map is shared for all matches that are occuring so a large server can be hosted and absolutely no one know all the visuals going on exist but their own. The server script would just tell a local script what to generate to produce those visuals from both player’s perspectives.