Server listing verification

[Southclaws]

For users to edit their listing and augment it with additional information like a description, images, graphs, etc.

That verification process must be as simple as possible and cover as many users' skill levels.

Here are some ideas:

• Generate a curl/wget/Invoke-WebRequest command that the user calls from their server that includes a unique token to prove they own it
• Build a simple announce.exe binary
• Put some unique token in the gamemode/hostname/map just once
• Procedurally generate an .amx filterscript that can be loaded once - it would make a HTTP call with the token built into the binary

[AliLogic]

Sounds amazing to me - however, I think we can use a different server variable and put token in there instead for it.

[Southclaws]

I realise the first one won't work because you could hijack a server running on the same IP but different port.

The request needs to come from within the server process itself.

[NotUnlikeTheWaves]

A token system where you can generate a token from open.mp and include it for example in your config to be sent with the announce process seems the easiest for me. This could be done without user registration even and with high enough entropy very unlikely for someone to guess.

[NotUnlikeTheWaves]

I'm more interested in specifically what we want to show on the listing. Dynamic data (e.g. a map showing user locations) or just static pages? Can people fetch data remotely or do they need to upload it to one of open.mp's services? Preferably no executing javascript inside a custom listing

[Southclaws]

A token system where you can generate a token from open.mp and include it for example in your config to be sent with the announce process seems the easiest for me. This could be done without user registration even and with high enough entropy very unlikely for someone to guess.

That's what I have in mind. The question is more about the user experience should work for this. The token could be placed inside some field like the mapname for a second then swapped back to what was there before. Or sent as a HTTP request.

I'm liking the idea of writing a simple filterscript, compiling it to an amx but leaving the token constant as a searchable pattern so at request time, a token is generated, injected into the .amx and the user simply downloads the .amx file to their server, and runs rcon loadfs etc and it will do something and verify the server.

[Southclaws]

HTTP is probably simpler, but the issue I see is that if someone is using shared hosting they could hijack another server:

• Claim ownership of a server
• Site gives you an amx with HTTP() call inside with the token
• User decompiles the amx, grabs the token
• Executes it with curl from the shared machine
• Server receives the request and now assumes the user owns a server they don't, it merely runs on the same IP with a different port

I think setting the mapname/gamemode/hostname to some token for a minute then swapping it back to the original is the only way to guarantee no foul play.

[Southclaws]

I'm more interested in specifically what we want to show on the listing. Dynamic data (e.g. a map showing user locations) or just static pages? Can people fetch data remotely or do they need to upload it to one of open.mp's services? Preferably no executing javascript inside a custom listing

I wasn't thinking anything crazy like that, just what it is right now but with a Markdown description - basically replicating what the "Server Advertisements" board was on the old forum. Just with Markdown.

In future, we could introduce more features. A live map would be a cool thing! And it would save server owners from setting up their own map.

But I think this stuff belongs in its own issue. This issue is just for server verification.

[wootcake]

Telling the server owner to set a token as language is probably the most convenient and fastest way to do. It can be done quickly via RCON command. I wouldn't want to load a random amx filterscript into my server that I don't know the contents of.

[Southclaws]

Obviously any FS would be open source.

[abhaysv]

The FS is the best solution as of now later we may move towards announce if needed