fix: remove client side sendTo

app.sendTo is now only available on the server as allowing this on the client enabled client spoofing.

Author: ashconnell

src/core/packets.js

@@ -15,7 +15,6 @@ const names = [
   'entityRemoved',
   'playerTeleport',
   'playerPush',
-  'sendTo',
   'kick',
 ]
 

src/core/systems/Apps.js

@@ -196,6 +196,9 @@ export class Apps extends System {
         if (internalEvents.includes(name)) {
           return console.error(`apps cannot send internal events (${name})`)
         }
+        if (!world.network.isServer) {
+          throw new Error('sendTo can only be called on the server')
+        }
         const player = world.entities.get(playerId)
         if (!player) return
         const event = [entity.data.id, entity.blueprint.version, name, data]

src/core/systems/ClientNetwork.js

@@ -40,11 +40,6 @@ export class ClientNetwork extends System {
     this.ws.send(packet)
   }
 
-  sendTo(playerId, name, data) {
-    const packet = writePacket('sendTo', { playerId, name, data })
-    this.ws.send(packet)
-  }
-
   async upload(file) {
     {
       // first check if we even need to upload it

src/core/systems/ServerNetwork.js

@@ -433,10 +433,6 @@ export class ServerNetwork extends System {
     this.sendTo(data.networkId, 'playerSessionAvatar', data.avatar)
   }
 
-  onSendTo = (socket, data) => {
-    this.sendTo(data.playerId, data.name, data.data)
-  }
-
   onDisconnect = (socket, code) => {
     socket.player.destroy(true)
     this.sockets.delete(socket.id)