Conversation
🤖 Augment PR SummarySummary: This PR introduces an initial “QUEST” system implementation for default (non-ruleset) rooms, storing quest state in Changes:
Technical Notes: Combat prepare/result hooks can short-circuit combat flow (negative return) for non-hostile quest interactions; NPC death events finalize quest outcomes and persist owner state. 🤖 Was this summary useful? React with 👍 or 👎 |
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
| } | ||
|
|
||
| // Q4: summon phantom | ||
| if ($qid == 'Q4' && $action == 'summon') { |
There was a problem hiding this comment.
Q4 的 summon 分支这里没有像其他任务一样校验 $clbpara['quest']['active']['Q4'] 是否存在，导致只要拿到照片道具就可能“凭空”生成/推进任务状态。这样也会让任务状态缺少 quest_start() 初始化字段（如 title / tier / start_time）。
Severity: medium
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
|
|
||
| // Q4: 花束安抚 | ||
| if ($qid == 'Q4') { | ||
| $slot = quest_find_item_slot($player, 'Q4', 'comfort'); |
There was a problem hiding this comment.
Q4 的完成逻辑依赖背包里存在 QuestAction=comfort 的花束道具，但当前任务启动/召唤流程看起来只会发放照片（start items），可能导致任务无法完成（除非花束在别处生成）。建议确认 q4_flower 的获取路径一定存在。
Severity: medium
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
| { | ||
| global $db, $tablepre; | ||
| if (empty($npc_id)) return false; | ||
| $result = $db->query("SELECT hp FROM {$tablepre}players WHERE pid = '$npc_id'"); |
There was a problem hiding this comment.
这里把 $npc_id 直接拼进 SQL（同类问题在 item.quest.php 更新 NPC 时也存在）；如果 LinkedNPCID/npc_id 可被篡改，存在 SQL 注入风险。考虑在进入查询前强制转换为整数并避免直接字符串拼接。
Severity: high
Other Locations
include/game/item.quest.php:100
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
| if (empty($qstate['cheer_points'])) $qstate['cheer_points'] = 0; | ||
| if (empty($qstate['cheer_turns'])) $qstate['cheer_turns'] = 0; | ||
| $qstate['cheer_points'] += !empty($player['final_damage']) ? $player['final_damage'] : 0; | ||
| $qstate['cheer_turns'] += 1; |
There was a problem hiding this comment.
Q7 的应援回合数在每次 attack_result_events 都会 +1，即使玩家此回合作为防守方（此时 final_damage 在攻击者 $pa 上）。这会让玩家在不造成伤害的情况下也能靠被动挨打达到 turn_need 完成任务。
Severity: medium
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
| } elseif ($qid == 'Q6') { | ||
| quest_fail('Q6', $owner, 'hide_npc_killed'); | ||
| } elseif ($qid == 'Q7') { | ||
| if ($killer_pid == $owner_pid) quest_complete('Q7', $owner); |
There was a problem hiding this comment.
Q7 的 NPC 死亡处理只在击杀者是任务拥有者时才 quest_complete()；如果偶像被第三方击杀，这里不会 fail 也不会清理任务，可能导致任务卡死在 active 状态。建议补齐非拥有者击杀时的失败/清理路径。
Severity: medium
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
- Q4 summon: add active quest check before processing - Q4 summon: spawn q4_flower item when phantom is summoned - Q7 cheer: only count turns when player is attacker - Q7 NPC death: fail quest if idol killed by third party
1 participant
No description provided.