jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-13 10:22:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(multiplayer): validate client resource paths

Browse Source
This commit is contained in:
Josh Creek
2026-09-01 22:45:04 +01:00
parent 56e8e2554c
commit e9ed8923c9
3 changed files with 15 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
multiplayer-next.md
+2
View File
@@ -1597,6 +1597,8 @@ Assignment projection now rejects fractional `slot` and `protocol_version` value
Allocated `ServerConfig` startup now enforces the opaque match/server ID contract, rejecting short or unsafe allocation flags before process launch.
Authenticated client REST methods now enforce opaque ticket, proposal, and match IDs before constructing request paths, preventing malformed identifiers from crossing the URL boundary.
Signed MatchNet claims now also require exact JSON string/integer types for every identity, protocol, expiry, slot, team, and generation field; string-number coercion is rejected before canonical signature verification.
Presentation progress: a shared `Game/themes/cosmic_clash_theme.tres` now gives the menu, lobby, matchmaking, and settings surfaces consistent button, input, option, and label styling. The custom-font portion of `TODO.md` remains open until a distributable font asset is selected.