why they can hack in this script?

[Nero]

ayothaya,151,171,3	script	Drops Trader	403,{
	mes .name$;
	mes "You currently have "+countitem(.Imagine_item)+" Mithril coin/s.";
	mes "Would you like to look at the shop?";
	next;
	if(select("Yes:No") == 2) {
		close;
	}
	close2;
	callshop "Imagine_SHOP",1;
	npcshopattach "Imagine_SHOP";
	dispbottom "You currently have "+countitem(.Imagine_item)+" Mithril coin/s.";
	end;

OnBuyItem:
	for(set @i,0; @i < getarraysize(@bought_nameid); set @i,@i+1) {
		for(set @j,0; @j < getarraysize(.Imagine_ITEMS); set @j,@j+2) {
			if(.iMAGINE_ITEMS[@j] == @bought_nameid[@i]) {
				set @itemcost,(.IMAGINE_ITEMS[(@j+1)]*@bought_quantity[@i]);
				set @totalcost,(@totalcost+@itemcost);
				break;
			}
		}
	}
	if(@totalcost > countitem(.Imagine_item)) {
		dispbottom "You don't have enough coin.";
	}
	else {
		for(set @i,0; @i < getarraysize(@bought_nameid); set @i,@i+1) {
			getitem @bought_nameid[@i],@bought_quantity[@i];
		}
		delitem .Imagine_item,@totalcost;
		dispbottom "Thank you for shopping.";
		dispbottom "You now have "+countitem(.Imagine_item)+" Mithril coin left.";
	}
	set @totalcost,0;
	deletearray @bought_nameid[0],128;
	deletearray @bought_quantity[0],128;
	end;

OnInit:
	npcshopdelitem "Imagine_SHOP",909;	 // Leave this alone
	set .name$,"[DropsTrader]";
	set .Imagine_item,674;	 // Input TCG ID
	setarray .Imagine_ITEMS[0],7086,2,7090,2,7091,2,7077,2,7076,2;	 // Input as many items as you want (item::price)



	for(set .@i,0; .@i < getarraysize(.IMAGINE_ITEMS); set .@i,.@i+2) {
		npcshopadditem "Imagine_SHOP",.IMAGINE_ITEMS[.@i],.Imagine_ITEMS[(.@i+1)];
	}
}


-	shop	Imagine_SHOP	139,909:1

 

in my past server, as iv'e used this script. Some people can hack or bug this script using hack programs.. 

i already post it in here before but im not satisfied with the feedbacks that ive receive.. Im really affraid to use dynamic shop or multi currency shop because of this...

 

any body can figure it out why?

[Digos]

I would like suggest to always put delitem before of getitem.

 

So, the script execution will stop if player don't have the item. This will prevent exploits like sending mail with the item attached.

[Nero]

so thats they hacked it? by using @mail?

[Digos]

I don't know exactly. @mail can be used to exploit bad coded scripts. Details http://eathena.ws/forum/tracker/issue-5098-mail-potential-exploit/

[Capuche]

I don't see any problem in this script (unless the price of Jellopy but no need to worry).

[Nero]

Im sorry that i cannon explain how they can hack it but as i observed they can get any items in that npc. this was also the problem of other eatena member before..

[nanakiwurtz]

Maybe they're using a program to retain the items (in this case the TCG), so the script thinks it's already deleted via delitem but actually it's not.

You could make a check before and after transaction.

Like this:

ayothaya,151,171,3    script    Drops Trader    403,{
    mes .name$;
    mes "You currently have "+countitem(.Imagine_item)+" Mithril coin/s.";
    mes "Would you like to look at the shop?";
    next;
    if(select("Yes:No") == 2) {
        close;
    }
    close2;
    callshop "Imagine_SHOP",1;
    npcshopattach "Imagine_SHOP";
    dispbottom "You currently have "+countitem(.Imagine_item)+" Mithril coin/s.";
    end;

OnBuyItem:
    for(set @i,0; @i < getarraysize(@bought_nameid); set @i,@i+1) {
        for(set @j,0; @j < getarraysize(.Imagine_ITEMS); set @j,@j+2) {
            if(.iMAGINE_ITEMS[@j] == @bought_nameid[@i]) {
                set @itemcost,(.IMAGINE_ITEMS[(@j+1)]*@bought_quantity[@i]);
                set @totalcost,(@totalcost+@itemcost);
                break;
            }
        }
    }
    if(@totalcost > countitem(.Imagine_item)) {
        dispbottom "You don't have enough coin.";
    }
    else {
        set .@before,countitem(.Imagine_item);
        set .@expected,.@before-@totalcost;
        delitem .Imagine_item,@totalcost;
        for(set @i,0; @i < getarraysize(@bought_nameid); set @i,@i+1) {
            getitem @bought_nameid[@i],@bought_quantity[@i];
        }
        set .@after,countitem(.Imagine_item);
        if (.@before == .@after || @.after != .@expected) logmes "WARNING: "+strcharinfo(0)+" is trying to buy items from NPC "+.name$+" illegally!";
        dispbottom "Thank you for shopping.";
        dispbottom "You now have "+countitem(.Imagine_item)+" Mithril coin left.";
    }
    set @totalcost,0;
    deletearray @bought_nameid[0],128;
    deletearray @bought_quantity[0],128;
    end;

OnInit:
    npcshopdelitem "Imagine_SHOP",909;     // Leave this alone
    set .name$,"[DropsTrader]";
    set .Imagine_item,674;     // Input TCG ID
    setarray .Imagine_ITEMS[0],7086,2,7090,2,7091,2,7077,2,7076,2;     // Input as many items as you want (item::price)



    for(set .@i,0; .@i < getarraysize(.IMAGINE_ITEMS); set .@i,.@i+2) {
        npcshopadditem "Imagine_SHOP",.IMAGINE_ITEMS[.@i],.Imagine_ITEMS[(.@i+1)];
    }
}


-    shop    Imagine_SHOP    139,909:1

[Emistry]

if you wan..you can try these 2....so far...never received any abusable feedback for these 2 script..

https://rathena.org/board/index.php?/files/file/2504-%7B?%7D/

or

trunk/npc/custom/quests/quest_shop.txt