search

NeonOdyssey / rdrp_logs

rdrp_logs is the default logging script for all rdrp scripts. rdrp_logs will allow scripts like rdrp_admin send console logs and discord logs to a specified channel, whenever a moderation / admin action has been sent.
https://rdrp.pixelperfect.gg
GNU General Public License v3.0
2 stars 0 forks source link

security issue #3

Open WhatTheHellx2 opened 2 years ago

WhatTheHellx2 commented 2 years ago

exposing webhooks on config file which can be accessed easily is a big mistake along with allowing clients to send discord message and console message , they can easily nuke your server/discord .

NeonOdyssey commented 2 years ago

Highly appreciate the heads up 👍

However the config file is a server only file. Therefore clients won't download or see the config.lua in joining the server.

WhatTheHellx2 commented 2 years ago

oh i see , my bad about config files then , but still client_exports still exposed to clients and with a aggressive even normal loops with big data they can nuke and hang your server (fxserver) / or nuking the discord which results in big timeout from discord webhook server. i had such problem before that's why was concern about this issue

NeonOdyssey commented 2 years ago

Interesting, what I will do is on the next commit I will remove the client side porting. If you spot anything else please let me know, as these scripts are all WIP

WhatTheHellx2 commented 2 years ago

i can suggest that if the client is not going to call those exports aggressively , you can put a delayer on those so that client can call the exports like every 1 sec only , just a though tho