Originally Posted by Lombra
AcceptTrade doesn't require a hardware event? That is terrible. Or are they being tricked into executing that somehow?
|
Yes, they are being tricked into executing that by catching any hardware events with a secure frame
I don't know how exactly they do that, but I could only manage catching any left-clicks
Originally Posted by Kanegasi
What about something like saving AcceptTrade() into a local object, wiping the main one to nil, then setting TradeFrameTradeButton's onclick script to call the local object. That way, a trade is accepted only if the Trade UI's confirm button is clicked.
|
Good idea. Or maybe without wiping the global one to nil, to not break any other Trade UI related addons.
Lua Code:
local oldAcceptTrade = AcceptTrade
function AcceptTrade()
if RunScript ~= RemoveExtraSpaces then
oldAcceptTrade()
end
end
TradeFrameTradeButton:SetScript("OnClick", AcceptTrade)
It might be really obvious, but why is
RemoveExtraSpaces not a
local scope function
It's only being used in ChatFrame.lua
@Resike: So there is no way to stop an addon message before it already has done the damage?
Edit: It looks like Blizzard is already checking for any suspicious whisper messages?
It's not possible to say "
loadstring" anymore in chat channels, including whisper
But they could still whisper something like
Lua Code:
pcall(_G["load".."string"](msg))