the client. Could be especially nasty if the client is running as root and
stuffcmds can come from anywhere. exploit details:
stuffcmds rcon_password <long password>
stuffcmds rcon <long command>
on your server, put `serverinfo no_pogo_stick 1' into your server.cfg. It's
called no_pogo_stick for two reasons: the effect is called "pogo stick" in the
source code in a comment from the original id source code and also as a minor
(and very week:/) obfustication for `cheaters' trying to set it in their
clients. However, the client checks for no_pogo_stick in the server info and
forces it on when appropriate and having them in disagreement would only make
prediction a little screwy anyway :). BTW, when enabled this actually fixes the
original bug that allowed bunny hopping in the first place (though you still
get a jump grunt when you try to bunny hop; minor bug).
for nice large amounts of client info to be sent to a QuakeForge server.
sv_main.c:
Append " QF" to the challenge reply. This DOES NOT break older clients
because atoi stops parsing at the first non-number character but
returns the value of what it successfully parsed. If a client does
choke on this, its libc is broken and not to spec.
cl_main.c:
Check for "QF" in the challenge string and if it's there, set the
QF extended info keys before connecting. Also, make sure the extended
info keys are NOT set prior to starting the connect process. This is
done is the CL_Disconnect function.
remove *qsg_version and *cap on disconnect
set *qsg_version and *cap after connection but only if the server presents
*qsg_version (it will have big enough info buffers if this key exists). Doesn't
yet send the updated values to the server as there is currently no way to do
so :( I started out creating a setfulluserinfo, but ran into design/security
problems with that approach. What's needed is to either find a secure way to
update these two star keys (however, special casing is ugly) or make them
non-star keys (I don't like that either: too easy to fiddle with). Another
possiblity is to force a reconnect after they are set.
both support this. The client tells the server it can support compressed
downloads by setting the z flag in the *cap userinfo. If the server detects
that the client supports compression, and the file to be downloaded is
compressed (more accurately, has the .gz extension), the server sends a special
download packet with a size of -2 (-1 indicates error),, percent of 0, followed
by the new name of the file (eg maps/foo.bsp.gz for maps/foo.bsp). The client
WILL NOT accept a new filename that doesn not match the old name for the length
of the old name. The client also will not accept a new name if there are . or
.. path components. If the client rejects the new name, it prints a warning
message and aborts that download.
code.
Then we have the completely purge of treating 'unsigned' as a type, it
is NOT a type, it is a TYPE MODIFIER!
Under gcc for x86 it happens to try and do something sane, just treat it
as a unsigned int, but that is EVIL, it is a MODIFIER and if ANYONE adds
code which uses unsigned as a type in itself I /WILL/ harm them!!!
In order to do so I:
* included strings.h and string.h in many files so various functions would be
defined
* Fixed model_t collision problem in cl_main.c (Solaris)
* com.c - corrected WORDS_BIGENDIAN spelling
* gl_draw.c - Use HAVE_GL_COLOR_INDEX8_EXT to avoid referencing
GL_COLOR_INDEX8_EXT when it isn't available
* net_udp.c - use socklen_t to appease AIX
little problem of mixed QFile and FILE. Since we're not using ZLib in
this tree, QFile makes no real sense. That didn't fix the real problem
I am having though.
Bill Currie
Forest Hale
Zephaniah E. Hull
Jeff Teunissen
Anton E. Gavrilov
Dabb
James Brown
Dan Olson
Loring Holden
Joseph Carter
Marcus Sundberg
Brian Koropoff