Galactic Empire wiki

Classic bug: Team maintenance password bypass

Bug ID GE-BUG-056
Affected versions Classic 3.2e and ge-next through 0.3.2
Status Verified in source; corrected in ge-next 0.3.3
Fixed in ge-next 0.3.3 (16-bit and 32-bit)
Primary source GECMDS.C: cmd_buy() and cmd_maint(); GEMAIN.C: fixplanetteam() in ge-next

Summary

A planet owner can set the special trade password team to reserve purchases for members of the owner's team. The BUY routine checks the planet's saved team code against the buyer's code. Classic GE's MAINT routine does not make that comparison: it treats team as an ordinary password. Any player who knows the literal word can pass the maintenance password check by entering MAINT team, even if the planet refuses to sell that player goods. ge-next inherited this behavior through 0.3.2.

Reproduction

  1. A player on a team claims a planet with at least 25,000 men and sets its trade password to team.
  2. A player outside that team orbits the planet with a damaged ship, enough cash, and no active combat restriction.
  3. The outsider is refused by BUY but enters MAINT team. In classic GE and ge-next through 0.3.2, maintenance begins despite the team restriction.

The planet still needs a working maintenance facility, and the command's ordinary payment and combat checks still apply. This bug bypasses the intended team-only access rule; it does not make maintenance free.

Cause

cmd_buy() recognizes team as a special password and compares plptr->teamcode with waruptr->teamcode. The classic and pre-0.3.3 cmd_maint() paths instead use only the generic literal password test: a supplied word matching plptr->password is accepted. The special value is not secret, so requiring the word team cannot enforce team membership. This is separate from the stale-team-code and team-identity problems described in Classic bug: Reused deleted team identifiers.

Correction in ge-next 0.3.3

In both 16-bit and 32-bit ge-next, cmd_maint() now calls fixplanetteam() to validate an old team restriction, then handles a live team password through a team-code comparison before considering ordinary passwords. A member of the planet's team may request maintenance without entering team; an outsider receives a team-access denial even if they supply that word. Other maintenance requirements and the handling of ordinary planet passwords are unchanged. ge-arena has a separate depot path with no planetary trade passwords and is unaffected.

See also

Retrieved from "https://manicpop.org/gewiki/index.php?title=Classic_bug:_Team_maintenance_password_bypass&oldid=2037"