The latest BETA for the Source engine, the one that adds a pure mode setting, also comes with a surprise twist. The oft hated cl_restrict_server_commands cvar that was introduced in an update months ago has been removed in the latest BETA. Before you sing your songs of praise, hold on, there is a catch.
The command is now enabled and locked by default. Why the change? Valve feels as though the variable was exploited by servers and its implementation and usage was wasted, effectively removing the protections the cvar added to protect the gaming clients.
What does this mean for plugins? There will need to be updates to those plugins that forces a command on a client. Authors of plugins that run client commands will need to contact Alfred Reynolds with a list of cvars or commands they would like to see added to an "allowed list." Cvars added to this list should permit plugins to continue to function as intended. Authors may still need to update their plugins to some degree, even with approved commands added to the allow list.
It should be noted that any command that "exploits a user's game process (rebinding keys, kills them, etc.)" will not be allowed.[break="read Alfred Reynold's response on the HLDS mailing list"]
The command is now enabled and locked by default. Why the change? Valve feels as though the variable was exploited by servers and its implementation and usage was wasted, effectively removing the protections the cvar added to protect the gaming clients.
What does this mean for plugins? There will need to be updates to those plugins that forces a command on a client. Authors of plugins that run client commands will need to contact Alfred Reynolds with a list of cvars or commands they would like to see added to an "allowed list." Cvars added to this list should permit plugins to continue to function as intended. Authors may still need to update their plugins to some degree, even with approved commands added to the allow list.
It should be noted that any command that "exploits a user's game process (rebinding keys, kills them, etc.)" will not be allowed.[break="read Alfred Reynold's response on the HLDS mailing list"]
The convar was removed as we had no effective way to otherwise protect it. Large numbers of servers were using exploits to set the value of this cvar without the users permission.
If you write a plugin that runs client commands and you believe you have a command that won't let you exploit a users game process (i.e rebind keys, kills them, etc) then mail me (offlist) the details and we can talk about adding it to the allowed list.
Zblock in particular can still function perfectly, they can use the API we specially added for them to query CVAR values and then kick users with cvars outside of their configuration ranges.
Comment