search

C0nw0nk / Garrys-Mod-Family-Sharing

Prevent players bypassing existing bans on Garrys Mod Servers via steam family sharing / shared accounts or buying a new GMod. Banned messages and banning lengths configurable with lots of extra useful custom features such as a ban tracker / tracking. This script is guaranteed to make players regret receiving a ban from your server in GarrysMod / GarryMod / Garry'sMod / Garry's Mod / G Mod / G-Mod familysharing alts / alternative are a thing of the past. familysharing / familyshared checks / checker / checked / checking. lua script addon addons
http://www.networkflare.com/
Other
34 stars 12 forks source link

enormous security flaw #10

Closed Divran closed 6 years ago

Divran commented 6 years ago

Hey so some guy on my friends list just sent this to me for unrelated reasons and I noticed that it's a shared file, and you're asking the server owner to put their steam API key near the top of the file.

This means that anyone who connects to the server will download a copy of the file containing the steam API key, so they can simply open the file, and find the API key. You should really put this in a different file which is serverside only.

Also you should probably stop making all the config variables global, because if some other mod happens to make global variables with the same name, it'll break your entire addon (See #6 )

C0nw0nk commented 6 years ago

As posted it here : https://github.com/C0nw0nk/Garrys-Mod-Family-Sharing/issues/9

Feel free to fix it yourself and make a pull request and I will update the repo with the pull request.

Be sure that you only do what is said in the pull request and your fix is related to splitting the file into server folder and client. If you include junk code or extra stuff I won't accept the pull request for obvious reasons.

I don't play Gmod anymore have not done so for years and do not intend to considering how old it is now.

Feel free to fix it as I tell everyone the Github repo will be updated if people make a pull request and the code in their pull request reflects what it says not pushing or advertising / spamming junk code etc. If you want to turrn this addon into a advertisement and insert junk code make a fork but this main repository is to be kept clean of such nonsense.

Matt-CompSci commented 6 years ago

I've fixed all of the issues mentioned here in #11

C0nw0nk commented 6 years ago

Thank you for submitting the pull request approved merged with main all reflects the separated Client side and Server side files and the Vars being in their appropriate tables to prevent conflicts.