Skip to content

Fix logistics network packet authorization#10468

Open
layue13 wants to merge 1 commit into
Creators-of-Create:mc1.21.1/devfrom
layue13:mc1.21.1/dev
Open

Fix logistics network packet authorization#10468
layue13 wants to merge 1 commit into
Creators-of-Create:mc1.21.1/devfrom
layue13:mc1.21.1/dev

Conversation

@layue13

@layue13 layue13 commented Jun 6, 2026

Copy link
Copy Markdown

Title

Fix locked logistics network packet authorization bypass

Summary

This PR moves locked logistics network permission checks to the real trust boundary: serverbound packet handling.

Previously, several logistics UIs checked mayInteract before opening, but their server-side packet handlers applied changes without revalidating network permissions. A non-owner near the block could forge packets to place package orders, edit requester settings, change stock ticker categories, query stock summaries, or mutate factory panel connections.

Changes

  • Added early mayInteract checks to logistics packet handlers before any expensive lookup, stock summary, network response, or block entity mutation.
  • Protected package order requests, redstone requester configuration, stock ticker category edits, category hiding, and stock summary requests.
  • Hardened stock keeper category refunds so the server only returns filters that actually exist in the current server-side category list.
  • Added factory panel permission checks for configuration, connection, and relocation packets.
  • Revalidated factory panel connection and relocation constraints server-side before mutating panel state.
  • Preserved existing packet wire formats; this is a server-side authorization fix only.

Risk

Low risk for unlocked or unowned logistics networks because existing mayInteract semantics still allow those interactions.

Locked networks become stricter only for forged, stale, or unauthorized packets, which is the intended behavior.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant