Potentially unnoticed bank exploit about servuo

[tr1age]

        public override bool OnDroppedInto(Mobile from, Container target, Point3D p)
        {
            bool canDrop = base.OnDroppedInto(from, target, p);

            if (canDrop && target is BankBox && !((BankBox)target).Opened)
            {
                return false;
            }

            return canDrop;
        }

Solution in containers.cs
#5059

[Voxpire]

After some digging, it appears that this may not actually be an issue;

Mobile.CanSee(Item item) bubbles up the item parent hierarchy, which eventually checks the bank and whether it is open or not.
https://github.com/ServUO/ServUO/blob/master/Server/Mobile.cs#L8624

If this exploit were possible, it would be due to some bad custom logic in the overriding PlayerMobile.CanSee(Item item) method.
https://github.com/ServUO/ServUO/blob/master/Scripts/Mobiles/PlayerMobile.cs#L4951

[bittiez]

I tested this on my personal servuo test server, and have seen it work on one live shard running Servuo, if you'd like to have a private discussion I can send you the client and you can test for yourself

[Voxpire]

You are more than welcome to DM me on Discord.

[Voxpire]

We can confirm that there is no issue, just an access level oversight;
GM+ level overrides the checks that would otherwise prevent this behaviour, which is why it appears to be a legitimate exploit.

[tr1age]

Can confirm there is a delay when swapping from GM to Player that allows you to still access the bank for a small period of time via the client while it plays catch up to know you do not have those perms, but if a player cannot ever set themselves to GM, this won't be an issue. False alarm and fell for it myself. The code above does remove that delay though so that is fun :P