From e0f7578fbe7c4fb253a59cb2d529cab366e3db0c Mon Sep 17 00:00:00 2001
From: elexis <elexis@wildfiregames.com>
Date: Tue, 14 Feb 2017 16:54:34 +0000
Subject: [PATCH] Ensure unique client GUIDs. Patch by sbirmi, fixes #3949.

Two clients chosing the same GUID is highly unlikely, yet possible.
A malicious client chosing an existing GUID would have resulted in
unassigning the player with that GUID.

This was SVN commit r19225.
---
 binaries/data/mods/public/gui/common/network.js       |  1 +
 .../mods/public/gui/credits/texts/programming.json    |  1 +
 source/network/NetHost.h                              |  3 ++-
 source/network/NetServer.cpp                          | 11 +++++++++++
 4 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/binaries/data/mods/public/gui/common/network.js b/binaries/data/mods/public/gui/common/network.js
index 9b230513c7..638462104a 100644
--- a/binaries/data/mods/public/gui/common/network.js
+++ b/binaries/data/mods/public/gui/common/network.js
@@ -71,6 +71,7 @@ function getDisconnectReason(id, wasConnected)
 	case 6: return translate("You have been banned");
 	case 7: return translate("Playername in use. If you were disconnected, retry in few seconds");
 	case 8: return translate("Server full");
+	case 9: return translate("Player identifier in use, retry connecting");
 	default:
 		warn("Unknown disconnect-reason ID received: " + id);
 		return sprintf(translate("\\[Invalid value %(id)s]"), { "id": id });
diff --git a/binaries/data/mods/public/gui/credits/texts/programming.json b/binaries/data/mods/public/gui/credits/texts/programming.json
index a09ad9eee8..80e4ec3787 100644
--- a/binaries/data/mods/public/gui/credits/texts/programming.json
+++ b/binaries/data/mods/public/gui/credits/texts/programming.json
@@ -177,6 +177,7 @@
 			{"nick": "Sandarac"},
 			{"nick": "sanderd17", "name": "Sander Deryckere"},
 			{"nick": "sathyam", "name": "Sathyam Vellal"},
+			{"nick": "sbirmi", "name": "Sharad Birmiwal"},
 			{"nick": "sbte", "name": "Sven Baars"},
 			{"nick": "scroogie", "name": "André Gemünd"},
 			{"nick": "scythetwirler", "name": "Casey X."},
diff --git a/source/network/NetHost.h b/source/network/NetHost.h
index 789efd8a6b..8f205c44da 100644
--- a/source/network/NetHost.h
+++ b/source/network/NetHost.h
@@ -67,7 +67,8 @@ enum NetDisconnectReason
 	NDR_KICKED,
 	NDR_BANNED,
 	NDR_PLAYERNAME_IN_USE,
-	NDR_SERVER_FULL
+	NDR_SERVER_FULL,
+	NDR_PLAYERGUID_IN_USE
 };
 
 class CNetHost
diff --git a/source/network/NetServer.cpp b/source/network/NetServer.cpp
index aa4b703027..d0682f2589 100644
--- a/source/network/NetServer.cpp
+++ b/source/network/NetServer.cpp
@@ -903,6 +903,7 @@ bool CNetServerWorker::OnAuthenticate(void* context, CFsmEvent* event)
 
 	CAuthenticateMessage* message = (CAuthenticateMessage*)event->GetParamRef();
 	CStrW username = SanitisePlayerName(message->m_Name);
+	CStr guid = message->m_GUID;
 
 	// Either deduplicate or prohibit join if name is in use
 	bool duplicatePlayernames = false;
@@ -919,6 +920,16 @@ bool CNetServerWorker::OnAuthenticate(void* context, CFsmEvent* event)
 		return true;
 	}
 
+	// Disconnect user if the provided GUID is already in use
+	if (std::find_if(
+		server.m_Sessions.begin(), server.m_Sessions.end(),
+		[&guid] (const CNetServerSession* session)
+		{ return session->GetGUID() == guid; }) != server.m_Sessions.end())
+	{
+		session->Disconnect(NDR_PLAYERGUID_IN_USE);
+		return true;
+	}
+
 	// Disconnect banned usernames
 	if (std::find(server.m_BannedPlayers.begin(), server.m_BannedPlayers.end(), username) != server.m_BannedPlayers.end())
 	{