Attack Crit Roll With No Target Exposes Entire Actor List to Players

[AvanMadisen]

Describe the bug

If a player rolls a crit on an weapon attack without having selected a target token, a dialog box opens up asking them to select an actor to use as the target, the lookup table in this box is populated with the entire actor list, regardless of permissions.
This happens on weapon attacks only.
This happens even is 'Automatic Apply Damage' is disabled.

My reason for selecting High priority is this would enable players to see hidden information, and I would be relying on my trust in my players to always remember to select a target token before rolling attacks.

The screen shots below are from my current game, the player only has permissions to see one actor, but the list includes every single actor in the entire game.

Reproduction

On a new game, with no mods installed, create two actors, give one A in both Strength and Close Combat (to maximise crit chance)
Create a player user and grant them permission to use the actor with the A ranks and not the other one.
Create a basic melee weapon and equipment he actor with the A ranks with one.
Log in as the new player, select that actor and open the character sheet.
Use the weapon to roll an attack, select Advantage to give highest dice, repeat this until an attack scores a crit.
Select the chat dialog to roll the crit, an error with appear saying that no actor token was selected, and a dialog will open with a lookup table showing both actors, even though the player only has permissions to see one of them.

System Info

Running Windows
Occurs in Foundry version 13 build 531
Occurs in both Chrome and Firefox

Logs

Tried pasting test but that didn't work.

Priority this issue should have?

High (a broken feature, major functional impact)

Validations

• Done a clean install of the system.
• Disabled all modules.
• Checked if the issue is present in a new world instance (create a new world in foundry using the Blade Runner system).

[Stefouch]

@Cussa The issue stands here :

blade-runner-foundry-vtt/src/components/roll/roller.js

Line 563 in 1ceea0d

const actors = game.actors.filter(a => a.type === ACTOR_TYPES.CHAR || a.isVehicle);

[Cussa]

Yeah. I was reading and my idea was to show only player actors and tokens visible on the current scene. That should solve the problem, from what I am reading...

[Cussa]

Hello @AvanMadisen !
Thanks for reporting this.

I am investigating here and from what I can see, there is only two cases that this window is presented:

1. If you are GM and has some tokens selected on the map, it will show the window with the current selected tokens (not targeted) to select the token to do the action on.
2. If you are not the GM (so you are a player), it will try to get the character associated with the player.

Associating a player with a character is a common thing done, as several systems (including Blade Runner) uses that to execute some operations on the player's character.

You, as a GM, can configure that for players, if necessary.

The intention of this window is exactly for GMs to be able to select an actor to do that.

Can you check if this would solve the issue?

[AvanMadisen]

Yes, having the player have a selected character stops the window from appearing for them, but now I've got some more issues, in that damage is not being applied to characters at all and crits get applied in a very weird way:

1. If a player has no token 'selected', crits are being applied to their own character.
2. If a player has a token 'selected', crits are applied to the character linked to that token.
3. If a player has multiple tokesn 'selected', crits are applied to only one of them, I haven't been able to figure out how it decides which one.

At no point in any of my testing has damage being taken off a character's health, either sheet or token, I have double checked and 'Automatic Apply Damage' is switched on, the game seems to be ignoring that setting by never applying damage and always applying crits...

Also, the only way crits were applied to any other characters from player attacks was if the player had seleted the token, but that is only possible if the player is 'owner' of the actor. A player's selected target token seems to be being ignored.

TBH, I'm fine to apply damage and crits manually, but the system is applying crits from a player's attack to the player's own character automatically!

[Stefouch]

Also, the only way crits were applied to any other characters from player attacks was if the player had seleted the token, but that is only possible if the player is 'owner' of the actor. A player's selected target token seems to be being ignored.

About this, it is a permission issue. A player cannot add a crit to an NPC controlled by another player or GM if they do not have the permission to edit their sheet.

And of course the GM don't give edit permission to their NPCs otherwise the player can see things they shouldn't.

To counter that, I think the solution is to create a socket call to the owner of the NPC.

[AvanMadisen]

To counter that, I think the solution is to create a socket call to the owner of the NPC.

Is that something I'd have to do as GM or does it need to be implimented into the module?

[Cussa]

@AvanMadisen no. I believe that Stefouch's answer is more directed to me, discussing how we could implement this on the system directly (player click to roll the damage, it sends a socket message to the GM, which then applies the damage).

I will try to work on this during the weekend.

[AvanMadisen]

Thanks for clarifying, I'm not familiar with development for Foundry so wasn't sure.

[Cussa]

After thinking a little bit about this issue, and doing some tests during the weekend, here is the proposed solution:

1. We will not allow the players to draw criticals against their own characters anymore.
2. We will use the target token to draw the critical.
3. Because of the permission system (and given I don't want to introduce sockets for this), I will create a message to the GM with the Critical Injury information, and a button (only visible to the GM) to apply the critical to the target.
4. If the player has more than one target selected, it will give a warn and not move ahead.

About the "Auto Apply Damage": @Stefouch I did some investigation and I see that this setting is not being used on the system anymore. Is that a left over that was not removed?
We would have a very similar issue: the player would not be able to apply the damage to the Token. I see we already have a functionality (right click on the chat) to apply the damage to the current target. That's only available to the GM.
Maybe we can think about improve the messages on the future to give the apply damage button (for the GM always, for the Player if they were the target).

Does it make sense?

[Cussa]

Just to add: we have an issue related to Auto Apply Damage (#57). I will probably leave this issue to address only the change of the critical execution.