Skip to content

Fix SSC login deadlock when players are crowd controlled before auth #3218

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Xekep wants to merge 2 commits into
base: general-devel
Choose a base branch
from
Open

Fix SSC login deadlock when players are crowd controlled before auth #3218

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c87669c
Allow SSC pre-login users to authenticate while disabled
Xekep Feb 27, 2026
caea4e7
Allow login while auth-gate CC is active (SSC/RequireLogin)
Xekep Feb 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion TShockAPI/Commands.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -846,7 +846,11 @@ private static void AttemptLogin(CommandArgs args)
return;
}

if (args.TPlayer.CCed && Main.ServerSideCharacter)
// Pre-login auth gates can disable movement (SSC/RequireLogin), which may mark the player as CCed.
// Allow login in that temporary state to avoid an auth deadlock.
var disabledForAuthGate = args.Player.IsDisabledForSSC
|| (!args.Player.IsLoggedIn && TShock.Config.Settings.RequireLogin);
Copy link

Copilot AI Feb 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

disabledForAuthGate includes !args.Player.IsLoggedIn, but this method already returns early when IsLoggedIn is true. Removing the redundant check would make the intent clearer and avoid implying that disabledForAuthGate could ever be evaluated in a logged-in state.

Suggested change
|| (!args.Player.IsLoggedIn && TShock.Config.Settings.RequireLogin);
|| TShock.Config.Settings.RequireLogin;

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Feb 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change allows /login to proceed while args.TPlayer.CCed when disabledForAuthGate is true, but the login flow still calls PlayerData.RestoreCharacter(...) (when SSC is enabled) which sends a SyncLoadout packet. Earlier in this method you note CC prevents loadout switching and can cause catastrophic desync; if the player is CCed due to the server-applied Webbed disable buff, the client may still reject the loadout sync even though login is now permitted. Consider explicitly clearing the server-applied disable CC (e.g., Webbed) before restoring/syncing character data, or otherwise ensuring the client is not CCed at the point the loadout index is synced.

Suggested change
|| (!args.Player.IsLoggedIn && TShock.Config.Settings.RequireLogin);
|| (!args.Player.IsLoggedIn && TShock.Config.Settings.RequireLogin);
// If the player is only CCed because of a server-side auth gate (e.g., Webbed to disable movement
// before login), clear that CC before we proceed into SSC restore/loadout sync. Otherwise the client
// may reject the SyncLoadout packet while still CCed, causing desync.
if (disabledForAuthGate && args.TPlayer.CCed)
{
for (int i = 0; i < args.TPlayer.buffType.Length; i++)
{
if (args.TPlayer.buffType[i] == Terraria.ID.BuffID.Webbed)
{
args.TPlayer.DelBuff(i);
i--;
}
}
// Ensure the auth-gate CC flag is cleared on the server-side Player instance.
args.TPlayer.webbed = false;
}

Copilot uses AI. Check for mistakes.
if (args.TPlayer.CCed && Main.ServerSideCharacter && !disabledForAuthGate)
Comment on lines +851 to +853
Copy link

Copilot AI Feb 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR description says /login should be allowed while CCed only for the SSC pre-login disabled state (IsDisabledForSSC), but disabledForAuthGate also treats RequireLogin as an auth-gate condition. If the intent is strictly SSC-only, drop the RequireLogin clause; if RequireLogin is also intended here, please update the PR description to match (and clarify why this remains gated behind Main.ServerSideCharacter).

Copilot uses AI. Check for mistakes.
{
args.Player.SendErrorMessage(GetString("You cannot login whilst crowd controlled."));
return;
Expand Down