Rudimentary auth for DeleteObj

limits distance to object, as well as validating random auth key.  added server_deleteObjDirect which is only for direct execution on the server, whereas server_deleteObj should be used for PVEH execution only

SQF/dayz_server/compile/server_deleteObj.sqf

@@ -1,10 +1,21 @@
 /*
-[_objectID,_objectUID,_activatingPlayer] call server_deleteObj;
+[_objectID,_objectUID,_activatingPlayer,_object,DZE_AuthKey] call server_deleteObj;
+For PV calls from the client use this function, otherwise if calling directly from the server use server_deleteObjDirect
 */
-private["_id","_uid","_key","_activatingPlayer"];
+private["_id","_uid","_key","_activatingPlayer","_object","_clientKey","_PlayerUID","_PUIDIndex"];
+
+if (count _this < 5) exitWith {diag_log "Server_DeleteObj error: Improper parameter format";};
 _id 	= _this select 0;
 _uid 	= _this select 1;
 _activatingPlayer 	= _this select 2;
+_object = _this select 3;
+_clientKey = _this select 4;
+_PlayerUID = getPlayerUID _activatingPlayer;
+_PUIDIndex = DZE_ServerPUIDArray find _PlayerUID;
+
+if (_object distance _activatingPlayer > (Z_VehicleDistance + 10)) exitWith {diag_log "Server_DeleteObj error: Delete verification failed, referenced player is too far away from object";};
+if (_PUIDIndex < 0) exitWith {diag_log "Server_DeleteObj error: PUID NOT FOUND ON SERVER";};
+if ((((DZE_ServerClientKeys select _PUIDIndex) select 0) != (owner _activatingPlayer)) || (((DZE_ServerClientKeys select _PUIDIndex) select 1) != _clientKey)) exitWith {diag_log "Server_DeleteObj error: CLIENT AUTH KEY INCORRECT OR UNRECOGNIZED";};
 
 if (isServer) then {
 	//remove from database
@@ -12,11 +23,11 @@ if (isServer) then {
 		//Send request
 		_key = format["CHILD:304:%1:",_id];
 		_key call server_hiveWrite;
-		diag_log format["DELETE: Player %1 deleted object with ID: %2",_activatingPlayer,_id];
+		diag_log format["DELETE: Player %1 ,with Player UID %2 deleted object with ID: %3",_activatingPlayer, _PlayerUID, _id];
 	} else  {
 		//Send request
 		_key = format["CHILD:310:%1:",_uid];
 		_key call server_hiveWrite;
-		diag_log format["DELETE: Player %1 deleted object with UID: %2",_activatingPlayer,_uid];
+		diag_log format["DELETE: Player %1 ,with Player UID %2 deleted object with UID: %3",_activatingPlayer, _PlayerUID, _uid];
 	};
-};
+};

SQF/dayz_server/compile/server_deleteObjDirect.sqf

@@ -0,0 +1,23 @@
+/*
+[_objectID,_objectUID,_activatingPlayer] call server_deleteObjDirect;
+*/
+private["_id","_uid","_key","_activatingPlayer"];
+
+_id 	= _this select 0;
+_uid 	= _this select 1;
+_activatingPlayer 	= _this select 2;
+
+if (isServer) then {
+	//remove from database
+	if (parseNumber _id > 0) then {
+		//Send request
+		_key = format["CHILD:304:%1:",_id];
+		_key call server_hiveWrite;
+		diag_log format["DELETE DIRECT: SERVER deleted object with ID: %1", _id];
+	} else  {
+		//Send request
+		_key = format["CHILD:310:%1:",_uid];
+		_key call server_hiveWrite;
+		diag_log format["DELETE DIRECT: SERVER deleted object with UID: %1", _uid];
+	};
+};

SQF/dayz_server/compile/server_handleSafeGear.sqf

@@ -112,7 +112,7 @@ switch (_status) do {
 		[_weapons,_magazines,_backpacks,_holder] call server_addCargo;
 		
 		// Delete safe from database
-		[_objectID,_objectUID,_player] call server_deleteObj;
+		[_objectID,_objectUID,_player] call server_deleteObjDirect;
 	};
 };
 

SQF/dayz_server/compile/server_playerSetup.sqf

@@ -223,8 +223,22 @@ _playerObj setVariable ["humanity",_humanity,true];
 _playerObj setVariable ["humanity_CHK",_humanity];
 _playerObj setVariable ["lastPos",getPosATL _playerObj];
 
-PVCDZ_plr_Login2 = [_worldspace,_state];
 _clientID = owner _playerObj;
+_randomKey = [];
+_randomInput = toArray "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890!@#$%^&*()_+-=\][{}:";
+for "_i" from 0 to 12 do {
+	_randomKey set [count _randomKey, (_randomInput call BIS_fnc_selectRandom)];
+};
+_randomKey = toString _randomKey;
+_findIndex = DZE_ServerPUIDArray find _playerID;
+if (_findIndex > -1) then {
+	DZE_ServerClientKeys set [_findIndex, [_clientID,_randomKey]];
+} else {
+	DZE_ServerPUIDArray set [(count DZE_ServerPUIDArray), _playerID];
+	DZE_ServerClientKeys set [(count DZE_ServerClientKeys), [_clientID,_randomKey]];
+};
+
+PVCDZ_plr_Login2 = [_worldspace,_state,_randomKey];
 _clientID publicVariableClient "PVCDZ_plr_Login2";
 if (dayz_townGenerator) then {
 	_clientID publicVariableClient "PVCDZ_plr_plantSpawner";
@@ -238,7 +252,6 @@ if (count _inventory > 2) then {
 	_playerObj setVariable["ServerMagArray",[_inventory select 1,_inventory select 2], false];
 };
 
-
 //Record Player Login/LogOut
 [_playerID,_characterID,1,(_playerObj call fa_plr2str),((_worldspace select 1) call fa_coor2str)] call dayz_recordLogin;
 

SQF/dayz_server/compile/server_publishVehicle3.sqf

@@ -104,7 +104,7 @@ _key call server_hiveWrite;
 	_newobject = _class createVehicle [0,0,0];
 
 	// remove old vehicle from DB
-	[_objectID,_objectUID,_activatingPlayer] call server_deleteObj;
+	[_objectID,_objectUID,_activatingPlayer] call server_deleteObjDirect;
 
 	// switch var to new vehicle at this point.
 	_object = _newobject;

SQF/dayz_server/compile/server_swapObject.sqf

@@ -33,7 +33,7 @@ if(isNull(_object)) then {
 if(_objectID == "0" && _objectUID == "0") then { 
 	_proceed = false;
 } else {
-	[_objectID,_objectUID,_activatingplayer] call server_deleteObj;
+	[_objectID,_objectUID,_activatingplayer,_obj] call server_deleteObjDirect;
 };
 
 _allowed = [_object, "Server"] call check_publishobject;

SQF/dayz_server/compile/server_updateObject.sqf

@@ -192,7 +192,7 @@ _object_killed = {
 	diag_log format["DELETE: Deleted by KEY: %1",_key];
 	#endif
 	
-	if (((typeOf _object) in DayZ_removableObjects) or ((typeOf _object) in DZE_isRemovable)) then {[_objectID,_objectUID,"__SERVER__"] call server_deleteObj;};
+	if (((typeOf _object) in DayZ_removableObjects) or ((typeOf _object) in DZE_isRemovable)) then {[_objectID,_objectUID,"__SERVER__"] call server_deleteObjDirect;};
 };
 
 _object_maintenance = {

SQF/dayz_server/init/server_functions.sqf

@@ -20,6 +20,7 @@ server_updateObject = compile preprocessFileLineNumbers "\z\addons\dayz_server\c
 server_playerDied = compile preprocessFileLineNumbers "\z\addons\dayz_server\compile\server_playerDied.sqf";
 server_publishObj = compile preprocessFileLineNumbers "\z\addons\dayz_server\compile\server_publishObject.sqf";	//Creates the object in DB
 server_deleteObj = compile preprocessFileLineNumbers "\z\addons\dayz_server\compile\server_deleteObj.sqf"; 	//Removes the object from the DB
+server_deleteObjDirect = compile preprocessFileLineNumbers "\z\addons\dayz_server\compile\server_deleteObjDirect.sqf"; 	//Removes the object from the DB, NO AUTH, ONLY CALL FROM SERVER, NO PV ACCESS
 server_playerSync = compile preprocessFileLineNumbers "\z\addons\dayz_server\compile\server_playerSync.sqf";
 zombie_findOwner = compile preprocessFileLineNumbers "\z\addons\dayz_server\compile\zombie_findOwner.sqf";
 server_Wildgenerate = compile preprocessFileLineNumbers "\z\addons\dayz_server\compile\zombie_Wildgenerate.sqf";