p-kuen / PatchProtect

A Prop Protection for Garry's Mod
12 stars 10 forks source link

Use Steam ID rather than Player Name for Console Commands #110

Open pspchucky opened 9 years ago

pspchucky commented 9 years ago

https://github.com/Patcher56/PatchProtect/blob/18faeaf421e67708d09e77cdc925e5648b956f7a/lua/patchprotect/server/antispam.lua#L69-L71

local rep = string.Replace( sv_PProtect.Settings.Antispam[ "concommand" ], "<player>", name )
local cmd = string.Explode( " ", rep )
RunConsoleCommand( cmd[1], unpack( cmd, 2 ) )

Really bad idea, multiple players can have the same or similar names. Earlier we ran into this problem where someone was changing their name to 3 letters of who they also wanted to match. Example:

Xua
XuavTheGreat

The spammer, Xua, would intentially spam to make PatchProtect execute the Console Command.

When executed, it caused the admin mod to find 2 matching players and it affects both. Things got worse when the spammer changed his name to the wildcard for everyone ( which is the asterisk symbol in our admin mod )

TL;DR: Passing the player name to RunConsoleCommand is a bad idea as most admin mods will find multiple people with a similar name. Use SteamID instead or add as an option.

d-kuen commented 9 years ago

Hey pspchucky, thank you for your bug report. I just sent a commit to github (https://github.com/Patcher56/PatchProtect/commit/f51835ecd7f3e3a4815170d25703b08b92bd1497). The problem is, that this is untested, because I am currently not able to check if it works or not (for some days actually). Would you be so kind and test it for me, so patcher and me can give it a go for workshop?

I am not sure if that works in console or not. Also I am not sure if this command works for every admin mod and the standard gmod-commands.

pspchucky commented 9 years ago

Confirm it works for Evolve, Existo, and ULX (I can't test every admin mod but any admin mods that use steamid params will work fine) But not standard gmod-commands as they require the player name (which is :-1: :cry:)

] kick
Usage:  kick < name >
d-kuen commented 9 years ago

Hmm, ok thanks! I will let it at this state for some days and will have a look how to fix this error.