This happen when I try create hook.

connect_attempt is a new hook which will become available with the next update (same for connect_initplayer)

When the player joins, the file download starts, if the player downloads files for a long time, the server kick off the player for the reason 'ping timeout', because of this, it is impossible to download all gfx/sfx files from the server

I'm going to mention this again, because this is very annoying.

The command spawnprojectile is flawed under the dedicated server, as the animated image of the item never gets removed, and just stays on top of the actual item.


EDIT:
When using images in a broadcast ( ) msg or msg2 the message won't centre (because it's registering the path as part of the message even though only the image shows).
This also applies to anything else apparently, such as hudtxt and hudtxt2.
Also, using images in a HUD text will add unnecessary spaces before and after the image.

In case if the Mute all when joining server feature enabled, user can bypass such hooks as join and connect. The solution is disabling voice chat feature on the whole server or calling functions with other hooks.

Example: on my server I use a custom anti-exploit feature which check user's IP if his UID marked as admin's UID. If the IP does not match the IP stored in separated .txt file, it bans the user automatically. But as for now I should enable call function not only on join and connect, but on various actions like serveraction, move. So the hacker will be banned not after he has joined the server, but after he used keys like F2, F3, F4 or moved on map.

And also it's possible to fake USGN IDs. One of our moderators () got faked and the hacker had an access to our admins script… That's why I wrote a script which checks if the admin IP is allowed. I mean, I can send the script to anyone but it's one of the first things I wrote on Lua so it looks poor. All it does is checks the UID (Steam and/or USGN). If the UID belongs to admin, it scans for the IP from a file. If the player's IP is not the same as in the file, the player being banned.

In log files this vulnerability looks like this:



#XXX — admin's UID
#YYY — not admin's UID

In other words, the hacker joins with admin's UID, but then it changes to non-admin's UID. But in TAB menu I am able to see that he is an admin and he can use admin script as well. And I've made a poor script which fixes this thing…

@ Kolia_rus: That's not true, it doesnt let the player join the server then. Just make sure sv_checkusgn is enabled.

@ The Dark Shadow: that's true. And this console command was set to 1 already.

@ Kolia_rus:
Either one, they get stuck in verification prompt

@ The Dark Shadow: what do you want to say? Do you think that I had a nightmare or dream about it? I saw it with my own eyes — player were using admin's USGN ID and the admin script too.

Stop playing on C4... You cannot fake USGN Id. Period.

@ Marcell, it is possible.

It's just not possible to do it to every ID, there are circumstances.

And no, sv_checkusgnlogin has nothing to do with this current exploit.

Yes, some conditions are required for that. Most of USGNs could not be hijacked. It doesn't affect the vast majority of the community.
DC and a few others endorsed that, and I don't think they're going to fix it.

Don't download random hacks/fake programs that steal your account information.

@ The Dark Shadow, it has nothing to do with the victim, anyone can get spoofed as long as they do X things (that I shall not bring up here).
Those things are super common and are part of the game, so there's no real way to avoid getting spoofed, unless you just don't play the game.

@ Mami Tomoe: Can you tell what exactly makes you get spoofed? Say X does Y, or it isn't necessary to say anything at all.

@ The Dark Shadow, I already directed all the info to @ DC.
This isn't new, just move along.

C-4 is the server I got banned at (as far as I remember). I don't play it since 2016. The vulnerability I am talking about happened on my server. By the way, I am so glad to know that you have checked the CS2D & USGN source code so you are sure that the UID can't be stolen.



If the fact "don't install hacks" sounds like a great knowledge for you, it does not mean that anyone else does not know it. I am playing CS2D since late 00s so of course I know about security basics.

I am completely not sure what guys do you mean. Do you think that we with @ Mami Tomoe: are trolling you?

Only DC and Simonas can do that, but I am still curious as interestingly never seen anyone doing such.

@ Marcell: this means that only DC and SQ can be sure if the code has vulnerabilities.

@ Kolia_rus:

Yes, that is right, but again, what I said, I never seen anyone doing similar since i playing this game, and it's more than 10 years.

@ Marcell, if you don't keep an open mind, you'll never be ready.

I predicted this would happen and created protection for my servers months in advance.
Also, I have plans as to what to do if this gets more widespread.