Community made patches and improvements

[PinkRobot]

Sorry that first post was a bit too up front, I changed it because I love the way you make all kinds of new stuff and I didn't mean to sound so abrupt.

I was thinking, a blacklist of commands that can not be used sounds like a tough job and hard to maintain because of the always changing nature of Nexuiz. Maybe a whitelist of things allowed to be changed by the mapper would work better? For example, even g_balance weapon settings can cause server and client crashes when they are set 'wrong'. I could imagine a great scenario where players could control the refire rates of weapons by pressing buttons, but the problem is that allowing mappers to choose without restrictions can cause server crashes or even client crashes. For example try setting electro secondary ammo to 0, refire and animtime to 0.001 and lifetime to 1000 or so. Spam spam spam and detonate. Bye bye server and/or client

Still, this patch already gets my PB Seal Of Approval

[MirceaKitsune]

It's ok Imo there are way too many cvars for a whitelist, but a blacklist should be good. If the blacklist can be made a cvar, it can be used in different areas of the code so only one blacklist needs to be maintained. Just hope I can find a way to do all this properly... I set the patch to 90% until then, and will look into it tonight.

So far I made a cvar (sv_allow_scripted_triggers) that can disable scripted triggers on the server, for the security reasons mentioned.

[LordHavoc]

I generally oppose maps tinkering with game settings in any way, it's the whole mapinfo trouble all over again (and I'm still really skeptical of some of the stuff in mapcfg).

I have a different question... What exactly are the uses for this feature?

[Sepelio]

Perhaps the easiest way to implement this is to only have it available for certain variables if thats possible. Then abuse of it can be avoided.

I see it as being useful in that you can make maps more interactive. Actions can have consequences. I personally would like to see an assault or onslaught match on a spacecraft where you have to sabotage the artificial gravity

[MirceaKitsune]

I generally oppose maps tinkering with game settings in any way, it's the whole mapinfo trouble all over again (and I'm still really skeptical of some of the stuff in mapcfg).

I have a different question... What exactly are the uses for this feature?

Imo it has good uses, since it allows maps to do awesome new things. Gravity triggers, buttons that can add or remove bots, dynamically change the behavior of weapons or anything else doable via console... as well as entities that can execute based on cvar values. To me this seems like a great feature, as it allows lots of new creative possibilities (especially for assault and singleplayer maps, or artistic demo maps).

An idea: I can use this to make a map containing a long hallway that can take you to any other map (I can have slimepit, toxic, stormkeep2, etc. on one side of the hallway, with a picture of each that you can walk into). At the end of the room I can make buttons that change gametype when you shoot them, closing doors to maps that aren't supported in that gametype. Not that I couldn't do this from the menu, but the possibility to make such a thing seems awesome to me

I'm currently working on a flexible filter which should keep all harmful commands away. I'll post it in a few hours when it will be ready.

[LordHavoc]

I'm currently working on a flexible filter which should keep all harmful commands away. I'll post it in a few hours when it will be ready.

And how is this "flexible filter" different from a cookbook method? (known working command sequences, with everything else not allowed)

It seems like if you had a set of generic command names (not literal console commands) in the qc to take care of each of these desired tasks that would be in the whitelist, it would avoid the console involvement entirely, and would be defining a standard way for the map to communicate its wishes.

More importantly, some things you described had a specialized equivalent in Quake1 that simply was not implemented in Nexuiz

(trigger_changelevel for example)

[Sepelio]

On another note, this would be another step on the road to making a singleplayer PvE style campaign possible

[MirceaKitsune]

Finished blacklist and updated on the tracker. It is a cookbook method, but I used a blacklist (a whitelist would be hard since there's a lot of safe cvars and commands the trigger could use). Apart from dangerous commands however, almost all important settings are .set rather than .seta, so most harmful things a bad map can do would be reverted on next startup. Also, if case an attack map does manage to brake persistent cvars (imo unlikely someone would make that and succeed too) the owner can easily delete the bad stuff from config.cfg... I do that all the time when I feel I might have a bad setting persisted.

Anyway, I don't want this to be a security breach or a feature that causes trouble and annoyance. My idea was finding a way that maps could use the possibilities of cvars / commands as map features, which is the intent of this patch. It would make a wonderful addition especially for assault and single player maps imo, which I thought would be a great and joyful thing

[PinkRobot]

Single player campaign by loading level after level, heck yes! That would be something i'd enjoy even if it were only as the entity that LordHavoc mentioned there.

[LordHavoc]

Finished blacklist and updated on the tracker. It is a cookbook method, but I used a blacklist (a whitelist would be hard since there's a lot of safe cvars and commands the trigger could use). Apart from dangerous commands however, almost all important settings are .set rather than .seta, so most harmful things a bad map can do would be reverted on next startup. Also, if case an attack map does manage to brake persistent cvars (imo unlikely someone would make that and succeed too) the owner can easily delete the bad stuff from config.cfg... I do that all the time when I feel I might have a bad setting persisted.

I recommend a whitelist method and use wildcard pattern matching, I.E. anything beginning with g_ is safe, sv_gravity is safe, etc, combined with a blacklist on anything containing $ or ; characters or other escape sequences that could be used to exploit things.

Anyway, I don't want this to be a security breach or a feature that causes trouble and annoyance. My idea was finding a way that maps could use the possibilities of cvars / commands as map features, which is the intent of this patch. It would make a wonderful addition especially for assault and single player maps imo, which I thought would be a great and joyful thing

I still think a select list of possible features is better than any level-designer-supplied command text, which may refer to commands and cvars we remove in later versions, where as the real support method would be updated accordingly (because we know what features can be used, and do not later get bug reports about one map we never heard of, not working properly in a future version).