Clients can access the inventories of incapacitated characters (e.g. put handcuffs on a stunned player, grab stuff from a dead character's inventory)

Subsurface/Source/Characters/Character.cs

@@ -1001,11 +1001,14 @@ namespace Barotrauma
         {
             if (!AllowInput || LockHands) return false;
 
+            //the inventory belongs to some other character
             if (inventory.Owner is Character && inventory.Owner != this)
             {
                 var owner = (Character)inventory.Owner;
 
-                return owner.isDead || owner.IsUnconscious || owner.Stun > 0.0f || owner.LockHands;
+                //can only be accessed if the character is incapacitated and has been selected
+                return selectedCharacter == owner &&
+                    (owner.isDead || owner.IsUnconscious || owner.Stun > 0.0f || owner.LockHands);
             }
 
             if (inventory.Owner is Item)

Subsurface/Source/Characters/CharacterNetworking.cs

@@ -277,18 +277,18 @@ namespace Barotrauma
         {
             if (GameMain.Server == null) return;
 
-            if (c.Character != this)
-            {
-#if DEBUG
-                DebugConsole.Log("Received a character update message from a client who's not controlling the character");
-#endif
-                return;
-            }
-
             switch (type)
             {
                 case ClientNetObject.CHARACTER_INPUT:
 
+                    if (c.Character != this)
+                    {
+#if DEBUG
+                        DebugConsole.Log("Received a character update message from a client who's not controlling the character");
+#endif
+                        return;
+                    }
+
                     UInt16 networkUpdateID = msg.ReadUInt16();
                     byte inputCount = msg.ReadByte();
 
@@ -345,6 +345,14 @@ namespace Barotrauma
                     }
                     else
                     {
+                        if (c.Character != this)
+                        {
+#if DEBUG
+                            DebugConsole.Log("Received a character update message from a client who's not controlling the character");
+#endif
+                            return;
+                        }
+
                         bool doingCPR = msg.ReadBoolean();
                         AnimController.Anim = doingCPR ? AnimController.Animation.CPR : AnimController.Animation.None;
                     }