Rudimentary auth for DeleteObj

limits distance to object, as well as validating random auth key.  added server_deleteObjDirect which is only for direct execution on the server, whereas server_deleteObj should be used for PVEH execution only

SQF/dayz_code/actions/AdvancedTrading/functions/DZE_deleteTradedVehicle.sqf

@@ -58,7 +58,7 @@ if ((count _VehKey2) > 0) then {
 	if (isNil "_localResult2") then {
 		_localResult2 = 0;
 	} else {
-		PVDZ_obj_Destroy = [(_VehKey2 select 2),(_VehKey2 select 3),player];
+		PVDZ_obj_Destroy = [(_VehKey2 select 2),(_VehKey2 select 3),player,(_VehKey2 select 1),DZE_AuthKey];
 		publicVariableServer "PVDZ_obj_Destroy";
 		deleteVehicle (_VehKey2 select 1);
 	};

SQF/dayz_code/actions/object_disassembly.sqf

@@ -67,16 +67,15 @@ for "_i" from 1 to 20 do {
         waitUntil {getNumber (configFile >> "CfgMovesMaleSdr" >> "States" >> (animationState player) >> "disableWeapons") == 1};
     };
 
-
-    // remove object
-    deleteVehicle _cursorTarget;
-    _cursorTarget = objNull;
     if (_realObjectStillThere) then { // send to server the destroy request
         _realObjectStillThere = false;
-        PVDZ_obj_Destroy = [_objectID,_objectUID,player];
+        PVDZ_obj_Destroy = [_objectID,_objectUID,player,_cursorTarget,DZE_AuthKey];
         publicVariableServer "PVDZ_obj_Destroy";
         diag_log [diag_ticktime, __FILE__, "Networked object, request to destroy", PVDZ_obj_Destroy];
     };
+    // remove object
+    deleteVehicle _cursorTarget;
+    _cursorTarget = objNull;
 
     ["Working",0,[20,40,15,0]] call dayz_NutritionSystem;
 

SQF/dayz_code/actions/object_dismantle.sqf

@@ -127,11 +127,11 @@ if (_proceed) then {
 
 	format [localize "STR_BLD_DISMANTLED",typeOf _object] call dayz_rollingMessages;
 	
-	PVDZ_obj_Destroy = [_objectID,_objectUID,player];
+	PVDZ_obj_Destroy = [_objectID,_objectUID,player,_object,DZE_AuthKey];
 	publicVariableServer "PVDZ_obj_Destroy";
 	
 	if (isServer) then {
-		PVDZ_obj_Destroy call server_deleteObj;
+		PVDZ_obj_Destroy call server_deleteObjDirect;
 	};
 	
 	//Need to update for sanity no client should ever create or delete anything

SQF/dayz_code/actions/object_pickup.sqf

@@ -79,7 +79,7 @@ if (_isOk) then {
 			["PartWoodPile",1,1] call fn_dropItem;
 			["equip_duct_tape",1,1] call fn_dropItem;
 		};
-		PVDZ_obj_Destroy = [(_holder getVariable["ObjectID","0"]),(_holder getVariable["ObjectUID","0"]),player];
+		PVDZ_obj_Destroy = [(_holder getVariable["ObjectID","0"]),(_holder getVariable["ObjectUID","0"]),player,_holder,DZE_AuthKey];
 		publicVariableServer "PVDZ_obj_Destroy";
 	};
 	deleteVehicle _holder;

SQF/dayz_code/actions/object_upgradeStorage.sqf

@@ -128,7 +128,7 @@ if ((_startUpgrade) AND (isClass(_upgradeConfig))) then {
 	_backpacks = getBackpackCargo _cursorTarget;
 	
 	//remove old tent
-	PVDZ_obj_Destroy = [_objectID,_objectUID,player];
+	PVDZ_obj_Destroy = [_objectID,_objectUID,player,_cursorTarget,DZE_AuthKey];
 	publicVariableServer "PVDZ_obj_Destroy";
 	deleteVehicle _cursorTarget;
 	

SQF/dayz_code/actions/object_upgradebuilding.sqf

@@ -124,7 +124,7 @@ _object setVariable ["characterID",_characterID,true];
 
 //remove old object
 deleteVehicle _cursorTarget;
-PVDZ_obj_Destroy = [_objectID,_objectUID,player];
+PVDZ_obj_Destroy = [_objectID,_objectUID,player,_object,DZE_AuthKey];
 publicVariableServer "PVDZ_obj_Destroy";
 
 // create a weaponholder with dismissed parts

SQF/dayz_code/actions/player_destroyTent.sqf

@@ -65,12 +65,12 @@ player addMagazine _emptycan;
 // Added Nutrition-Factor for work
 ["Working",0,[20,40,15,0]] call dayz_NutritionSystem;
 
-PVDZ_obj_Destroy = [_objectID,_objectUID,player];
+PVDZ_obj_Destroy = [_objectID,_objectUID,player,_obj,DZE_AuthKey];
 publicVariableServer "PVDZ_obj_Destroy";
 
 //Send killed for object
 if (isServer) then {
-	PVDZ_obj_Destroy call server_deleteObj;
+	PVDZ_obj_Destroy call server_deleteObjDirect;
 } else {
 	PVDZ_veh_Save = [_obj, "killed"];
 	publicVariableServer "PVDZ_veh_Save";

SQF/dayz_code/actions/remove.sqf

@@ -154,7 +154,7 @@ if (_proceed && _success) then {
 		deleteVehicle _obj;
 		
 		if(!_isWreck && !_isWreckBuilding) then {
-			PVDZ_obj_Destroy = [_objectID,_objectUID,player];
+			PVDZ_obj_Destroy = [_objectID,_objectUID,player,_obj,DZE_AuthKey];
 			publicVariableServer "PVDZ_obj_Destroy";
 		};
 

SQF/dayz_code/actions/trade_any_bicycle.sqf

@@ -183,7 +183,7 @@ if (_finished) then {
 
 						//if(_objectID != "0" && _objectUID != "0") then {
 					
-						PVDZ_obj_Destroy = [_objectID,_objectUID,_activatingPlayer];
+						PVDZ_obj_Destroy = [_objectID,_objectUID,_activatingPlayer,_obj,DZE_AuthKey];
 						publicVariableServer "PVDZ_obj_Destroy";
 
 						deleteVehicle _obj; 

SQF/dayz_code/actions/trade_any_bicycle_old.sqf

@@ -156,7 +156,7 @@ if (_qty >= _qty_in) then {
 								_objectID 	= _obj getVariable ["ObjectID","0"];
 								_objectUID	= _obj getVariable ["ObjectUID","0"];
 
-								PVDZ_obj_Destroy = [_objectID,_objectUID,_activatingPlayer];
+								PVDZ_obj_Destroy = [_objectID,_objectUID,_activatingPlayer,_obj,DZE_AuthKey];
 								publicVariableServer "PVDZ_obj_Destroy";
 
 								deleteVehicle _obj; 

SQF/dayz_code/actions/trade_any_boat.sqf

@@ -159,7 +159,7 @@ if (_finished) then {
 
 				if(local _obj && !isNull _obj && alive _obj && !_notSetup) then {
 
-					PVDZ_obj_Destroy = [_objectID,_objectUID,_activatingPlayer];
+					PVDZ_obj_Destroy = [_objectID,_objectUID,_activatingPlayer,_obj,DZE_AuthKey];
 					publicVariableServer "PVDZ_obj_Destroy";
 
 					deleteVehicle _obj; 

SQF/dayz_code/actions/trade_any_boat_old.sqf

@@ -142,7 +142,7 @@ if (_qty >= _qty_in) then {
 						_objectID 	= _obj getVariable ["ObjectID","0"];
 						_objectUID	= _obj getVariable ["ObjectUID","0"];
 
-						PVDZ_obj_Destroy = [_objectID,_objectUID,_activatingPlayer];
+						PVDZ_obj_Destroy = [_objectID,_objectUID,_activatingPlayer,_obj,DZE_AuthKey];
 						publicVariableServer "PVDZ_obj_Destroy";
 
 						deleteVehicle _obj;

SQF/dayz_code/actions/trade_any_vehicle.sqf

@@ -189,7 +189,7 @@ if (_finished) then {
 
 						//if(_objectID != "0" && _objectUID != "0") then {
 
-						PVDZ_obj_Destroy = [_objectID,_objectUID,_activatingPlayer];
+						PVDZ_obj_Destroy = [_objectID,_objectUID,_activatingPlayer,_obj,DZE_AuthKey];
 						publicVariableServer "PVDZ_obj_Destroy";
 
 						deleteVehicle _obj;

SQF/dayz_code/actions/trade_any_vehicle_free.sqf

@@ -185,7 +185,7 @@ if (_finished) then {
 
 						//if(_objectID != "0" && _objectUID != "0") then {
 
-						PVDZ_obj_Destroy = [_objectID,_objectUID,_activatingPlayer];
+						PVDZ_obj_Destroy = [_objectID,_objectUID,_activatingPlayer,_obj,DZE_AuthKey];
 						publicVariableServer "PVDZ_obj_Destroy";
 
 						deleteVehicle _obj;

SQF/dayz_code/actions/trade_any_vehicle_old.sqf

@@ -163,7 +163,7 @@ if (_qty >= _qty_in) then {
 							_objectID 	= _obj getVariable ["ObjectID","0"];
 							_objectUID	= _obj getVariable ["ObjectUID","0"];
 
-							PVDZ_obj_Destroy = [_objectID,_objectUID,_activatingPlayer];
+							PVDZ_obj_Destroy = [_objectID,_objectUID,_activatingPlayer,_obj,DZE_AuthKey];
 							publicVariableServer "PVDZ_obj_Destroy";
 
 							deleteVehicle _obj; 

SQF/dayz_code/compile/player_packTent.sqf

@@ -53,7 +53,7 @@ if (_ownerID in [dayz_characterID,dayz_playerUID] or typeOf _obj in _campItems)
 	_magazines = getMagazineCargo _obj;
 	_backpacks = getBackpackCargo _obj;
 
-	PVDZ_obj_Destroy = [_objectID,_objectUID,player];
+	PVDZ_obj_Destroy = [_objectID,_objectUID,player,_obj,DZE_AuthKey];
 	publicVariableServer "PVDZ_obj_Destroy";
 	deleteVehicle _obj;
 

SQF/dayz_code/init/variables.sqf

@@ -538,6 +538,8 @@ DZE_maintainRange = ((DZE_PlotPole select 0)+20);
 if (isNil "DZE_slowZombies") then {DZE_slowZombies = false;};
 
 if (isServer) then {
+	DZE_ServerPUIDArray = [];
+	DZE_ServerClientKeys = [];
 	dayz_traps = [];
 	dead_bodyCleanup = [];
 	needUpdate_objects = [];
@@ -567,6 +569,7 @@ if (isServer) then {
 };
 
 if (!isDedicated) then {
+	DZE_AuthKey = "";
 	DZE_LastPingResp = diag_tickTime;
 	dayz_buildingBubbleMonitor = [];
 	DayZ_fuelCans = ["ItemJerrycan","ItemFuelcan","ItemFuelBarrel"];

SQF/dayz_code/system/player_monitor.fsm

@@ -18,9 +18,9 @@ item13[] = {"Parse_Login",2,250,-66.532227,557.409241,33.467773,607.409241,0.000
 item14[] = {"Hive_Bad",4,218,125.000000,550.000000,225.000000,600.000000,10.000000,"Hive" \n "Bad"};
 item15[] = {"ERROR__Wrong_HIVE",2,250,325.000000,550.000000,425.000000,600.000000,0.000000,"ERROR:" \n "Wrong HIVE" \n "Version"};
 item16[] = {"Character_Setup",4,218,-175.000000,600.000000,-75.000000,650.000000,0.000000,"Character" \n "Setup"};
-item17[] = {"Phase_One",2,4346,-75.000000,650.000000,25.000000,700.000000,0.000000,"Phase One"};
+item17[] = {"Phase_One",2,250,-75.000000,650.000000,25.000000,700.000000,0.000000,"Phase One"};
 item18[] = {"Response",4,218,-175.000000,700.000000,-75.000000,750.000000,0.000000,"Response"};
-item19[] = {"Phase_Two",2,250,-75.000000,750.000000,25.000000,800.000000,0.000000,"Phase Two"};
+item19[] = {"Phase_Two",2,4346,-75.000000,750.000000,25.000000,800.000000,0.000000,"Phase Two"};
 item20[] = {"Dead_Player",4,218,125.000000,750.000000,225.000000,800.000000,0.000000,"Dead" \n "Player"};
 item21[] = {"ERROR__Player_Already",2,250,325.000000,750.000000,425.000000,800.000000,0.000000,"ERROR:" \n "Player Already" \n "Dead"};
 item22[] = {"Alive",4,218,-175.000000,800.000000,-75.000000,850.000000,0.000000,"Alive"};
@@ -243,8 +243,8 @@ link127[] = {107,32};
 link128[] = {108,109};
 link129[] = {109,110};
 link130[] = {110,64};
-globals[] = {0.000000,0,0,0,0,640,480,3,262,6316128,1,-406.909515,81.978119,1232.519287,318.468689,656,918,1};
+globals[] = {0.000000,0,0,0,0,640,480,3,262,6316128,1,-716.139587,391.207581,1442.645874,-117.093102,656,924,1};
-window[] = {2,-1,-1,-32000,-32000,1350,829,2787,260,1,674};
+window[] = {0,-1,-1,-1,-1,1259,1614,3572,163,1,674};
 *//*%FSM</HEAD>*/
 class FSM
 {
@@ -738,6 +738,7 @@ class FSM
                          "" \n
                          "_worldspace = 	PVCDZ_plr_Login2 select 0;" \n
                          "_state =			PVCDZ_plr_Login2 select 1;" \n
+                         "DZE_AuthKey = PVCDZ_plr_Login2 select 2;" \n
                          "" \n
                          "player setVariable [""Achievements"",[],false];" \n
                          "" \n

SQF/dayz_code/traps/functions/remove.sqf

@@ -5,12 +5,12 @@ _objectID = _obj getVariable ["ObjectID","0"];
 _objectUID = _obj getVariable ["ObjectUID","0"];
 
 if (isServer) then {
-	[_objectID,_objectUID,"__SERVER__"] call server_deleteObj;
+	[_objectID,_objectUID,"__SERVER__",_obj] call server_deleteObjDirect;
 } else {
 	if (count _this == 2) then {
 		//single use trap triggered, remove with no animation
 		//For normal remove let object_pickup.sqf perform deletion to ensure player has room in gear first, no others remove at same time and animation runs
-		PVDZ_obj_Destroy = [_objectID,_objectUID,player];
+		PVDZ_obj_Destroy = [_objectID,_objectUID,player,_obj,DZE_AuthKey];
 		publicVariableServer "PVDZ_obj_Destroy";
 		deleteVehicle _obj;
 	};

SQF/dayz_server/compile/server_deleteObj.sqf

@@ -1,10 +1,21 @@
 /*
-[_objectID,_objectUID,_activatingPlayer] call server_deleteObj;
+[_objectID,_objectUID,_activatingPlayer,_object,DZE_AuthKey] call server_deleteObj;
+For PV calls from the client use this function, otherwise if calling directly from the server use server_deleteObjDirect
 */
-private["_id","_uid","_key","_activatingPlayer"];
+private["_id","_uid","_key","_activatingPlayer","_object","_clientKey","_PlayerUID","_PUIDIndex"];
+
+if (count _this < 5) exitWith {diag_log "Server_DeleteObj error: Improper parameter format";};
 _id 	= _this select 0;
 _uid 	= _this select 1;
 _activatingPlayer 	= _this select 2;
+_object = _this select 3;
+_clientKey = _this select 4;
+_PlayerUID = getPlayerUID _activatingPlayer;
+_PUIDIndex = DZE_ServerPUIDArray find _PlayerUID;
+
+if (_object distance _activatingPlayer > (Z_VehicleDistance + 10)) exitWith {diag_log "Server_DeleteObj error: Delete verification failed, referenced player is too far away from object";};
+if (_PUIDIndex < 0) exitWith {diag_log "Server_DeleteObj error: PUID NOT FOUND ON SERVER";};
+if ((((DZE_ServerClientKeys select _PUIDIndex) select 0) != (owner _activatingPlayer)) || (((DZE_ServerClientKeys select _PUIDIndex) select 1) != _clientKey)) exitWith {diag_log "Server_DeleteObj error: CLIENT AUTH KEY INCORRECT OR UNRECOGNIZED";};
 
 if (isServer) then {
 	//remove from database
@@ -12,11 +23,11 @@ if (isServer) then {
 		//Send request
 		_key = format["CHILD:304:%1:",_id];
 		_key call server_hiveWrite;
-		diag_log format["DELETE: Player %1 deleted object with ID: %2",_activatingPlayer,_id];
+		diag_log format["DELETE: Player %1 ,with Player UID %2 deleted object with ID: %3",_activatingPlayer, _PlayerUID, _id];
 	} else  {
 		//Send request
 		_key = format["CHILD:310:%1:",_uid];
 		_key call server_hiveWrite;
-		diag_log format["DELETE: Player %1 deleted object with UID: %2",_activatingPlayer,_uid];
+		diag_log format["DELETE: Player %1 ,with Player UID %2 deleted object with UID: %3",_activatingPlayer, _PlayerUID, _uid];
 	};
-};
+};

SQF/dayz_server/compile/server_deleteObjDirect.sqf

@@ -0,0 +1,23 @@
+/*
+[_objectID,_objectUID,_activatingPlayer] call server_deleteObjDirect;
+*/
+private["_id","_uid","_key","_activatingPlayer"];
+
+_id 	= _this select 0;
+_uid 	= _this select 1;
+_activatingPlayer 	= _this select 2;
+
+if (isServer) then {
+	//remove from database
+	if (parseNumber _id > 0) then {
+		//Send request
+		_key = format["CHILD:304:%1:",_id];
+		_key call server_hiveWrite;
+		diag_log format["DELETE DIRECT: SERVER deleted object with ID: %1", _id];
+	} else  {
+		//Send request
+		_key = format["CHILD:310:%1:",_uid];
+		_key call server_hiveWrite;
+		diag_log format["DELETE DIRECT: SERVER deleted object with UID: %1", _uid];
+	};
+};

SQF/dayz_server/compile/server_handleSafeGear.sqf

@@ -112,7 +112,7 @@ switch (_status) do {
 		[_weapons,_magazines,_backpacks,_holder] call server_addCargo;
 		
 		// Delete safe from database
-		[_objectID,_objectUID,_player] call server_deleteObj;
+		[_objectID,_objectUID,_player] call server_deleteObjDirect;
 	};
 };
 

SQF/dayz_server/compile/server_playerSetup.sqf

@@ -223,8 +223,22 @@ _playerObj setVariable ["humanity",_humanity,true];
 _playerObj setVariable ["humanity_CHK",_humanity];
 _playerObj setVariable ["lastPos",getPosATL _playerObj];
 
-PVCDZ_plr_Login2 = [_worldspace,_state];
 _clientID = owner _playerObj;
+_randomKey = [];
+_randomInput = toArray "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890!@#$%^&*()_+-=\][{}:";
+for "_i" from 0 to 12 do {
+	_randomKey set [count _randomKey, (_randomInput call BIS_fnc_selectRandom)];
+};
+_randomKey = toString _randomKey;
+_findIndex = DZE_ServerPUIDArray find _playerID;
+if (_findIndex > -1) then {
+	DZE_ServerClientKeys set [_findIndex, [_clientID,_randomKey]];
+} else {
+	DZE_ServerPUIDArray set [(count DZE_ServerPUIDArray), _playerID];
+	DZE_ServerClientKeys set [(count DZE_ServerClientKeys), [_clientID,_randomKey]];
+};
+
+PVCDZ_plr_Login2 = [_worldspace,_state,_randomKey];
 _clientID publicVariableClient "PVCDZ_plr_Login2";
 if (dayz_townGenerator) then {
 	_clientID publicVariableClient "PVCDZ_plr_plantSpawner";
@@ -238,7 +252,6 @@ if (count _inventory > 2) then {
 	_playerObj setVariable["ServerMagArray",[_inventory select 1,_inventory select 2], false];
 };
 
-
 //Record Player Login/LogOut
 [_playerID,_characterID,1,(_playerObj call fa_plr2str),((_worldspace select 1) call fa_coor2str)] call dayz_recordLogin;
 

SQF/dayz_server/compile/server_publishVehicle3.sqf

@@ -104,7 +104,7 @@ _key call server_hiveWrite;
 	_newobject = _class createVehicle [0,0,0];
 
 	// remove old vehicle from DB
-	[_objectID,_objectUID,_activatingPlayer] call server_deleteObj;
+	[_objectID,_objectUID,_activatingPlayer] call server_deleteObjDirect;
 
 	// switch var to new vehicle at this point.
 	_object = _newobject;

SQF/dayz_server/compile/server_swapObject.sqf

@@ -33,7 +33,7 @@ if(isNull(_object)) then {
 if(_objectID == "0" && _objectUID == "0") then { 
 	_proceed = false;
 } else {
-	[_objectID,_objectUID,_activatingplayer] call server_deleteObj;
+	[_objectID,_objectUID,_activatingplayer,_obj] call server_deleteObjDirect;
 };
 
 _allowed = [_object, "Server"] call check_publishobject;

SQF/dayz_server/compile/server_updateObject.sqf

@@ -192,7 +192,7 @@ _object_killed = {
 	diag_log format["DELETE: Deleted by KEY: %1",_key];
 	#endif
 	
-	if (((typeOf _object) in DayZ_removableObjects) or ((typeOf _object) in DZE_isRemovable)) then {[_objectID,_objectUID,"__SERVER__"] call server_deleteObj;};
+	if (((typeOf _object) in DayZ_removableObjects) or ((typeOf _object) in DZE_isRemovable)) then {[_objectID,_objectUID,"__SERVER__"] call server_deleteObjDirect;};
 };
 
 _object_maintenance = {

SQF/dayz_server/init/server_functions.sqf

@@ -20,6 +20,7 @@ server_updateObject = compile preprocessFileLineNumbers "\z\addons\dayz_server\c
 server_playerDied = compile preprocessFileLineNumbers "\z\addons\dayz_server\compile\server_playerDied.sqf";
 server_publishObj = compile preprocessFileLineNumbers "\z\addons\dayz_server\compile\server_publishObject.sqf";	//Creates the object in DB
 server_deleteObj = compile preprocessFileLineNumbers "\z\addons\dayz_server\compile\server_deleteObj.sqf"; 	//Removes the object from the DB
+server_deleteObjDirect = compile preprocessFileLineNumbers "\z\addons\dayz_server\compile\server_deleteObjDirect.sqf"; 	//Removes the object from the DB, NO AUTH, ONLY CALL FROM SERVER, NO PV ACCESS
 server_playerSync = compile preprocessFileLineNumbers "\z\addons\dayz_server\compile\server_playerSync.sqf";
 zombie_findOwner = compile preprocessFileLineNumbers "\z\addons\dayz_server\compile\zombie_findOwner.sqf";
 server_Wildgenerate = compile preprocessFileLineNumbers "\z\addons\dayz_server\compile\zombie_Wildgenerate.sqf";