fix: Prevent setting properties of higher privileged mobiles (#1420)

--------- Co-authored-by: Kamron Batman <3953314+kamronbatman@users.noreply.github.com>
2023-07-16 07:01:33 +02:00 · 2023-07-16 07:01:33 +02:00 · e9fa2bf9fa
commit e9fa2bf9fa
parent 8ff105ac46
3 changed files with 26 additions and 0 deletions
--- a/Projects/UOContent/Commands/Properties.cs
+++ b/Projects/UOContent/Commands/Properties.cs
@ -363,6 +363,14 @@ namespace Server.Commands
        {
            try
            {
+                // Don't allow staff to be modified if they are under StaffAccess command
+                if (obj is Mobile mob &&
+                    (mob.AccessLevel > from.AccessLevel ||
+                     mob.Account?.AccessLevel > from.AccessLevel))
+                {
+                    return "You cannot modify a higher privileged mobile.";
+                }
+
                if (toSet is AccessLevel newLevel)
                {
                    var reqLevel = newLevel switch