ID:1986029
 
Not a bug
BYOND Version:509.1314
Operating System:Linux
Web Browser:Chrome 46.0.2490.86
Applies to:Dream Daemon
Status: Not a bug

This is not a bug. It may be an incorrect use of syntax or a limitation in the software. For further discussion on the matter, please consult the BYOND forums.
Descriptive Problem Summary: It is possible to change client.key and client.ckey.

Numbered Steps to Reproduce Problem: Attempt to change client objects' keys and/or ckeys.
Observe that it does affect the value of the variable.

Code Snippet (if applicable) to Reproduce Problem:
/client/New()
..()
key = "[key][key]"


Expected Results: Attempting to compile code which assigned directly to client.(c)key would fail, attempting access via .vars["ckey"] would fail at runtime.

Actual Results: Able to change keys. If two client objects are changed to have the same key, and it is a key neither of them owns, input() breaks for one of the clients; if one of them does own the key (i.e. it is that client's "real" key), the non-owning client is disconnected.

Does the problem occur:
Every time? Or how often? Every time
In other games? Yes
In other user accounts? Yes
On other computers? Yes

When does the problem NOT occur? N/A

Did the problem NOT occur in any earlier versions? If so, what was the last version that worked? Unknown

Workarounds: Unknown

Lummox JR resolved issue (Not a bug)
The ability to change client.key and client.ckey is entirely allowed.
Then the reference is wrong in calling /client/var/key and /client/var/ckey "read-only values".

It seems strange to be allowed to freely change the value that essentially represents that client to BYOND, is there a particular reason it's intentionally allowed?
I don't know why it's allowed, only that it is. But the reference definitely needs to be updated.
Is it specifically allowed by BYOND, or is there just nowhere it's disallowed? It seems a rather strange thing to allow.
There's actual code that lets it be changed and accounts for it.
- If I change my client's key to that of another user, that user is entirely unable to connect; DS simply states that another connection has been made using that user's key.

- If I change another logged-in user's key to my own (and possibly my own to theirs?), I can DC them and take their client object, along with any privileges/verbs associated with that object.

edit:
- If I change my own key, then connect again, I can connect multiple clients from the same BYOND account.

double-edit: First of these only appears to happen for local users and/or users from the same IP (?), second is intermittent if it wasn't a fluke the first time, third is consistent.
These issues are only meaningful to games that allow this. You can simply not add code to your game that changes client.ckey.
I think this was added way back in the day as a counterpart to the ability to change client.mob -- changing client.ckey/key to match an existing mob will connect you to it.

It's gotten a bit wonky over the years though, and was never really recommended for any practical usage.