Fix a critical exploit

3 files changed, 32 insertions, 8 deletions

diff --git a/conf/magic.conf.template b/conf/magic.conf.template
index 1b425722..ddeac883 100644
--- a/conf/magic.conf.template
+++ b/conf/magic.conf.template
@@ -1468,27 +1468,39 @@ NONMAGIC SILENT SPELL easter-invader-spawn : "#c" =
              spawn(rbox(location(caster), 20), caster, 1047, random(random(5)), 1, 100000);
 
 NONMAGIC SILENT SPELL world-shift : "#S00" =
-    (((REQUIRE (script_int(caster, "Easter_2010_QuestState") >> 7) & 3 == 2)
-     => (REQUIRE rdistance(location(caster), @("028-1.gat", 63, 67)) < 5) =>
+    (REQUIRE (script_int(caster, "Easter_2010_QuestState") >> 16) & 1 == 1 && (script_int(caster, "Easter_2010_QuestState") >> 7) & 3 == 2) => # Travel only works when you have both helped the doctor at least thrice and have defeated the invader - top level requirement.
+     (  (REQUIRE count_item(caster, "DarkPetal")) # Allow unlimited travel with the petal
+     => ((REQUIRE rdistance(location(caster), @("028-1.gat", 63, 67)) < 5) =>
      	         EFFECT sfx(location(caster), SFX_TELEPORT, 200);
                         WAIT 8000;
                         warp(caster, @("009-1.gat", 55, 37));
                         sfx(location(caster), SFX_TELEPORT, 200);
          |
-         (REQUIRE (map_nr(location(caster)) != 28 && count_item(caster, "DarkPetal"))) =>
+         (REQUIRE map_nr(location(caster)) != 28) =>
                  EFFECT inithp = hp(caster); // Store this value.
                         sfx(location(caster), SFX_TELEPORT, 200);
-                        WAIT 8000;
+                        IF (map_nr(location(caster)) == 9 || map_nr(location(caster)) == 1 || map_nr(location(caster)) == 21 || map_nr(location(caster)) == 20) THEN WAIT 8000;
+                        ELSE WAIT 20000;
                         IF (hp(caster) < inithp) THEN ABORT; // Cancel teleport if the player took damage during channel time (hacky, but for most purposes should work.)
                         warp(caster, @("028-1.gat", 63, 67));
                         sfx(location(caster), SFX_TELEPORT, 200);
         )
-     | REQUIRE (rdistance(location(caster), @("028-1.gat", 63, 67)) < 5 && (script_int(caster, "Easter_2010_QuestState") >> 17) & 1 == 0)
-                => EFFECT set_script_variable(caster, Easter_2010_QuestState, script_int(caster, "Easter_2010_QuestState") | (1 << 17));
+     | (REQUIRE (rdistance(location(caster), @("028-1.gat", 63, 67)) < 5 )
+                => EFFECT set_script_variable(caster, "Easter_2010_QuestState", script_int(caster, "Easter_2010_QuestState") | (1 << 17));
                           sfx(location(caster), SFX_TELEPORT, 200);
                           WAIT 8000;
                           warp(caster, @("009-1.gat", 55, 37));
                           sfx(location(caster), SFX_TELEPORT, 200);
+       | (REQUIRE map_nr(location(caster)) != 28 && (script_int(caster, "Easter_2010_QuestState") >> 17) & 1 == 0)  # Allow for one free warp home without the petal
+         => EFFECT inithp = hp(caster); // Store this value.
+                   sfx(location(caster), SFX_TELEPORT, 200);
+                   IF (map_nr(location(caster)) == 9 || map_nr(location(caster)) == 1 || map_nr(location(caster)) == 21 || map_nr(location(caster)) == 20) THEN WAIT 8000;
+                   ELSE WAIT 20000;
+                   IF (hp(caster) < inithp) THEN ABORT; // Cancel teleport if the player took damage during channel time (hacky, but for most purposes should work.)
+                   set_script_variable(caster, "Easter_2010_QuestState", script_int(caster, "Easter_2010_QuestState") | (1 << 17));
+                   warp(caster, @("028-1.gat", 63, 67));
+                   sfx(location(caster), SFX_TELEPORT, 200);
+       )
      )
 
 NONMAGIC SILENT SPELL easter-invader-killer : "#z" =
diff --git a/npc/009-1_Hurnscald/old_woman.txt b/npc/009-1_Hurnscald/old_woman.txt
index a8d02128..62f427e7 100644
--- a/npc/009-1_Hurnscald/old_woman.txt
+++ b/npc/009-1_Hurnscald/old_woman.txt
@@ -70,6 +70,7 @@ L_NohMask_Fake_Satchel:
 L_Easter:
     if ((Easter_2010_QuestState >> E10_STATE_ROSE_SHIFT) & E10_STATE_ROSE_MASK == E10_STATE_ROSE_ROSE_COMPLETE) goto L_Easter_Complete;
     if ((Easter_2010_QuestState >> E10_STATE_ROSE_SHIFT) & E10_STATE_ROSE_MASK == E10_STATE_ROSE_RETURNED) goto L_Easter_Gaveup;
+    if ((Easter_2010_QuestState >> E10_FLAG_RETURN_READY_SHIFT) & E10_FLAG_RETURN_READY_MASK == E10_FLAG_RETURN_READY) goto L_Defeat_Impossible;
     if ((Easter_2010_QuestState & E10_STATE_EGG_MASK) == E10_STATE_EGG_COLLECTING) goto L_Easter_Check;
     if ((Easter_2010_QuestState & E10_STATE_EGG_MASK) == E10_STATE_EGG_COLLECTED) goto L_Easter_Reward;
     if ((Easter_2010_QuestState & E10_STATE_EGG_MASK) == E10_STATE_EGG_REWARDED) goto L_Easter_Hint;
@@ -172,6 +173,7 @@ L_Easter_Hint:
 
 
 L_Easter_Complete:
+    if ((Easter_2010_QuestState >> E10_FLAG_RETURN_READY_SHIFT) & E10_FLAG_RETURN_READY_MASK != E10_FLAG_RETURN_READY) goto L_Help_Impossible;
     if ((Easter_2010_QuestState >> E10_STATE_REWARDS_SHIFT) & E10_STATE_REWARDS_MASK == 0) goto L_Easter_Complete_New_Rewards;
     if ((Easter_2010_QuestState >> E10_STATE_REWARDS_SHIFT) & E10_STATE_REWARDS_MASK == E10_STATE_REWARDS_MASK) goto L_Easter_Done_All;
     
@@ -275,6 +277,16 @@ L_Hats_No_Room:
     mes "\"Please see me again when you are ready, honey.\"";
     close;
 
+L_Help_Impossible:
+    mes "[Old Woman]";
+    mes "She seems confused. \"How did you get back here without defeating the evil force plaguing that world, and without giving up? That shouldn't be possible...\"";
+    close;
+
+L_Defeat_Impossible:
+    mes "[Old Woman]";
+    mes "She seems confused. \"How did you manage to get back here without helping that nice man to fix things, and without giving up? That shouldn't be possible...\"";
+    close;
+
 // The all important rose die script. Hooked into the old woman script for now.
 OnPCDieEvent:
     if (countitem(E10_TOKEN_ID) < 1) end;
diff --git a/npc/028-1/Doctor2.txt b/npc/028-1/Doctor2.txt
index e828e91b..1a4b9f36 100644
--- a/npc/028-1/Doctor2.txt
+++ b/npc/028-1/Doctor2.txt
@@ -381,7 +381,7 @@ L_island_end_menu_loop:
     set @i, 0;
     if (@c == 0) goto L_island_post_menu_loop_sub;
 L_island_end_menu_loop_sub:
-    if (@submenu$[@c] == @menuitems$[@index]) goto L_island_end_menu_loop;
+    if (@submenu$[@i] == @menuitems$[@index]) goto L_island_end_menu_loop;
     set @i, @i + 1;
     if (@i < @c) goto L_island_end_menu_loop_sub;
 L_island_post_menu_loop_sub:
@@ -395,7 +395,7 @@ L_island_post_menu_loop_sub:
          @submenu$[2], -,
          @submenu$[3], -;
     set @menu, @menu - 1;
-    if (@menu >= 4) goto L_island_oo_range;
+    if (@menu >= 4 || @menu < 0) goto L_island_oo_range;
     if (@submenuindex[@menu] == 8 || @submenuindex[@menu] == 9)
         goto L_At_Island_Resolve;