]> git.xonotic.org Git - xonotic/darkplaces.git/commit
changed Cmd_AddCommand to only work for console commands, not client commands execute...
authorhavoc <havoc@d7cf8633-e32d-0410-b094-e92efae38249>
Fri, 12 Jan 2007 03:40:35 +0000 (03:40 +0000)
committerhavoc <havoc@d7cf8633-e32d-0410-b094-e92efae38249>
Fri, 12 Jan 2007 03:40:35 +0000 (03:40 +0000)
commit3b27c0e3bc751cbf1f7c562c2bebfd3ec9b18f58
tree7815e800157c34a7df0b484f8b418bbf7161ea97
parent75e3d76db6a9f2d71456738dcea0d9c9668b4cd6
changed Cmd_AddCommand to only work for console commands, not client commands executed on the server, Cmd_AddCommand_WithClientCommand has been added to allow separate command functions for console commands and client commands, this got rid of a lot of cmd_source == src_command checks
this refactoring fixes a security vulnerability in the clcommand builtin provided by KRIMZON_SV_PARSECLIENTCOMMAND, which was able to execute many commands on the server console, and that put the burden on the QC code to validate command safety, which was not intended
in short: this fixes a remote console command execution vulnerability that affected a few games/mods

git-svn-id: svn://svn.icculus.org/twilight/trunk/darkplaces@6685 d7cf8633-e32d-0410-b094-e92efae38249
cl_demo.c
cmd.c
cmd.h
host_cmd.c
sv_user.c