Community Forums: Handout titles leak for unshared handouts

Handout titles leak for unshared handouts

1551988671

Pro

For players the Campaign object in javascript contains all handouts, even the ones not yet shared with them. At least the titles and images are accessible by them.

1551990980

Dragon Dreamer

Permalink Quote

Hello Rob F.,  Can you provide us with screenshots of this issue and where this is being seen/leaked? Also, can you provide us with the details of how to replicate this? Thanks.

1552003274

Rob F.

Pro

Permalink Quote

If i type in the developers console of my browser the following: `for (let x of Campaign.handouts.models) { console.log(x.attributes.name);}` I get all names of handouts in the game, even the ones not shared with me. If I call `x.view.render()` i even get the popup view, the text doesn't seem to load, but pictures do load.

1552068259

Dragon Dreamer

Permalink Quote

Hello Again Rob F., I have passed this information along to our devs. We hope to have an answer for you soon.

1552145773

Drespar

Roll20 Team

Permalink Quote

Hi Rob, The way this functions is the lesser of two evils. It is here so it loads faster and dynamically, and communicate with Firebase if there are any changes. The only bleed you really get is its name and is not really an issue in most cases unless someone is purposefully cheating within your game-- this then falls under a social issue we cannot really control. All of that said, the devs are aware of this and will be keeping it in mind for future improvements in this realm.

Cookie Preferences

Handout titles leak for unshared handouts