From e9fa2bf9fa27888075e7e527e0fe354b4c061332 Mon Sep 17 00:00:00 2001
From: Mink80 <46659983+Mink80@users.noreply.github.com>
Date: Sun, 16 Jul 2023 07:01:33 +0200
Subject: [PATCH] fix: Prevent setting properties of higher privileged mobiles
 (#1420)

---------

Co-authored-by: Kamron Batman <3953314+kamronbatman@users.noreply.github.com>
---
 Projects/UOContent/Commands/Properties.cs           | 8 ++++++++
 Projects/UOContent/Gumps/Props/SetCustomEnumGump.cs | 9 +++++++++
 Projects/UOContent/Gumps/Props/SetListOptionGump.cs | 9 +++++++++
 3 files changed, 26 insertions(+)

diff --git a/Projects/UOContent/Commands/Properties.cs b/Projects/UOContent/Commands/Properties.cs
index 1f35f1147..5bd2f818f 100644
--- a/Projects/UOContent/Commands/Properties.cs
+++ b/Projects/UOContent/Commands/Properties.cs
@@ -363,6 +363,14 @@ namespace Server.Commands
         {
             try
             {
+                // Don't allow staff to be modified if they are under StaffAccess command
+                if (obj is Mobile mob &&
+                    (mob.AccessLevel > from.AccessLevel ||
+                     mob.Account?.AccessLevel > from.AccessLevel))
+                {
+                    return "You cannot modify a higher privileged mobile.";
+                }
+
                 if (toSet is AccessLevel newLevel)
                 {
                     var reqLevel = newLevel switch
diff --git a/Projects/UOContent/Gumps/Props/SetCustomEnumGump.cs b/Projects/UOContent/Gumps/Props/SetCustomEnumGump.cs
index de0d86f6f..9c422aa1f 100644
--- a/Projects/UOContent/Gumps/Props/SetCustomEnumGump.cs
+++ b/Projects/UOContent/Gumps/Props/SetCustomEnumGump.cs
@@ -1,6 +1,7 @@
 using System;
 using System.Reflection;
 using Server.Commands;
+using Server.Commands.Generic;
 using Server.Network;
 
 namespace Server.Gumps
@@ -16,6 +17,14 @@ namespace Server.Gumps
 
         public override void OnResponse(NetState sender, RelayInfo relayInfo)
         {
+            var from = sender.Mobile;
+
+            if (!BaseCommand.IsAccessible(from, m_Object))
+            {
+                from.SendMessage("You may no longer access their properties.");
+                return;
+            }
+
             var index = relayInfo.ButtonID - 1;
 
             if (index >= 0 && index < m_Names.Length)
diff --git a/Projects/UOContent/Gumps/Props/SetListOptionGump.cs b/Projects/UOContent/Gumps/Props/SetListOptionGump.cs
index f123bb613..4f714aadf 100644
--- a/Projects/UOContent/Gumps/Props/SetListOptionGump.cs
+++ b/Projects/UOContent/Gumps/Props/SetListOptionGump.cs
@@ -1,5 +1,6 @@
 using System.Reflection;
 using Server.Commands;
+using Server.Commands.Generic;
 using Server.Network;
 
 using static Server.Gumps.PropsConfig;
@@ -164,6 +165,14 @@ namespace Server.Gumps
 
         public override void OnResponse(NetState sender, RelayInfo info)
         {
+            var from = sender.Mobile;
+
+            if (!BaseCommand.IsAccessible(from, m_Object))
+            {
+                from.SendMessage("You may no longer access their properties.");
+                return;
+            }
+
             var index = info.ButtonID - 1;
 
             if (index >= 0 && index < m_Values.Length)