Fcvar_server_can_execute

[garry]

So, what con commands should I ALLOW the server to run on the client? Can we make a list? Here's all the ones I have seen mentioned so far that are blocked but have a legitimate use:

r_cleardecals

[Lexic]

[QUOTE=garry;16270520]So, what con commands should I ALLOW the server to run on the client? Can we make a list? Here's all the ones I have seen mentioned so far that are blocked but have a legitimate use:

r_cleardecals[/QUOTE]

stopsounds

[Slayer3032]

[QUOTE=garry;16270520]So, what con commands should I ALLOW the server to run on the client? Can we make a list? Here's all the ones I have seen mentioned so far that are blocked but have a legitimate use:

r_cleardecals[/QUOTE]

stopsounds

Maybe a function to do this also.

[conman420]

Are all lua made concommands allowed?

[Slayer3032]

[QUOTE=conman420;16270924]Are all lua made concommands allowed?[/QUOTE]

From what I've seen.

[garry]

Yeah they are

[Bkacjios]

use
say
+showscores

[mcd1992]

r_cleardecals (stupid crowbars -_- )
stopsounds (do it)
mat_fullbright (dark maps nuff said)
retry (for mic error when people cant hear you for some reason)
say (for chat controlled lua not for immature "lol you said balls" moments)

thats all i can think of at the moment...

[Horsey]

setinfo

[Overv]

[QUOTE=blackops7799;16271677]say[/QUOTE]

That has no use at all. If you want to do stuff like imitating, use chat.AddText.

[mcd1992]

[QUOTE=Horsey;16271838]setinfo[/QUOTE]

name is the only thing you can do w/o error and i assume garrys is going to fix that soon :(

[url]http://wiki.garrysmod.com/?title=Player.SetPData[/url]

[Python1320]

- net_graph wouldn't be too bad unless someone finds it offending that a graph has been added on his screen. I use it a lot to point out how to optimize their contraptions.
Or if we could have lua counterpart (hooks or something) for some parts of the graph it wouldn't be too bad even if I couldn't do net_graph on clients anymore. I could write fancy gui graphs with the hooks and detect server lag.
- disconnect? No reason to not be forbidden. Not exploitable.
- showconsole? Or wait, no. It didn't work even if I issued that on clients. I was thinking if I could allow turning consoles on for clients so they could explore the miracles of console without -console or such stuff.
- noclip, also no reason to be forbidden.

[Noobulater]

[QUOTE=Lexic;16269802]You don't appear to be replying to my point. Regardless, if a single client decides that it doesn't wish you to run `stopsounds` on it, then they can live with the noisy consequences of their actions.[/QUOTE]

You're right, but right now I don't see any easy solution in order for me to change what I want to allow and not allow.

[QUOTE=Python1320;16271943]- net_graph wouldn't be too bad unless someone finds it offending that a graph has been added on his screen. I use it a lot to point out how to optimize their contraptions.
Or if we could have lua counterpart (hooks or something) for some parts of the graph it wouldn't be too bad even if I couldn't do net_graph on clients anymore. I could write fancy gui graphs with the hooks and detect server lag.
- disconnect? No reason to not be forbidden. Not exploitable.
- showconsole? Or wait, no. It didn't work even if I issued that on clients. I was thinking if I could allow turning consoles on for clients so they could explore the miracles of console without -console or such stuff.
- noclip, also no reason to be forbidden.[/QUOTE]

-StopSounds shouldn't be forbidden as well.

[conman420]

[QUOTE=mcd1992;16271760]
mat_fullbright (dark maps nuff said)
retry (for mic error when people cant hear you for some reason)
say (for chat controlled lua not for immature "lol you said balls" moments)

thats all i can think of at the moment...[/QUOTE]

Most of those the client would need to type it in. Why on earth would the server need to run those on the client?

Fullbright is a cheat as well.

Also noclip should be done in lua by setting the movetype.

[mcd1992]

[QUOTE=conman420]Most of those the client would need to type it in. Why on earth would the server need to run those on the client?

Fullbright is a cheat as well.

Also noclip should be done in lua by setting the movetype.[/QUOTE]

sv_cheats 1
ulx cexec <all> mat_fullbright 1
sv_cheats 0

im messing with cvar2 module right now, ive read it can set mat_fullbright and sv_cheats clientside to on

idk what i said about noclip

[Slayer3032]

connect can still be ran right?

If not it should be allowed.

[Overv]

Connect can be used maliciously though.

[Slayer3032]

[QUOTE=Overv;16274141]Connect can be used maliciously though.[/QUOTE]

Lua can be used maliciously.

That shouldn't undermine the other uses of something

[Noobulater]

You could take almost any command and make it malicious.

[Skondra]

[QUOTE=Noobulater;16274565]You could take almost any command and make it malicious.[/QUOTE]

Pics or it didn't happen.

[Bkacjios]

[QUOTE=Overv;16274141]Connect can be used maliciously though.[/QUOTE]

So what if something CAN be malicious.. Almost all commands could be used maliciously..

Anyway, if you block connect what will sassilization do?

[Lexic]

[QUOTE=blackops7799;16275653]Anyway, if you block connect what will sassilization do?[/QUOTE]

I suspect everything after "Call a sex line" in this:
[media]http://www.youtube.com/watch?v=NisCkxU544c[/media]

[ecabc]

Bypass'd setinfo and bind ect ;)

and you forgetting all the tricks like

[lua]pl:SendLua[[RunConsoleCommand(""[[bind\t]],[[w]],[[lol]])]][/lua]

[Kill coDer]

My old sprint and stamina script pressed -speed for the player when they ran out, clientside..

FCVAR_SERVER_CAN_EXECUTE prevented server running command: -speed

Is there a better way for me to do this?

[mcd1992]

[QUOTE=Kill coDer;16278535]My old sprint and stamina script pressed -speed for the player when they ran out, clientside..

FCVAR_SERVER_CAN_EXECUTE prevented server running command: -speed

Is there a better way for me to do this?[/QUOTE]

[lua]ply:SendLua("LocalPlayer():ConCommand(\"-speed\")")[/lua]

[Lap]

If we're going to add more to the whitelist then add all the toggle based player actions and movements like -speed, -walk, and -attack as well as their + and normal variants. There's quite a few of those that are useful.

[Lexic]

[QUOTE=ecabc;16277688][lua]pl:SendLua[[RunConsoleCommand(""[[bind\t]],[[w]],[[lol]])]][/lua][/QUOTE]That's not valid Lua.

[Python1320]

[QUOTE=mcd1992;16273211]sv_cheats 1
ulx cexec <all> mat_fullbright 1
sv_cheats 0

im messing with cvar2 module right now, ive read it can set mat_fullbright and sv_cheats clientside to on

idk what i said about noclip[/QUOTE]

require("cvar2")
function ulx.cc_cheats( ply, command, argv, args )
if #argv < 1 then
ULib.tsay( ply, ulx.LOW_ARGS, true )
return
end

local xiits = 0
if argv[ 2 ] == "on" ||  argv[ 2 ] == "1" then
    xiits = 1
elseif argv[ 2 ] == "off" ||  argv[ 2 ] == "0" then
    xiits = 0
end

local targets, err = ULib.getUsers( argv[ 1 ], _, true, ply )
if not targets then
ULib.tsay( ply, err, true )
return
end

for _, v in ipairs( targets ) do
    cvar2.ReplicateData(v:UserID()-1,"sv_cheats",tostring(xiits)) -- TODO: Add a check if cvar2 is not loaded
    if xiits == 1 then
    ulx.logUserAct( ply, v, "#A enabled cheats on #T" )
    else
    ulx.logUserAct( ply, v, "#A disabled cheats on #T" )
    end
end


end
ulx.concommand( "cheats", ulx.cc_cheats, "<user> (1/0) - Set clientside cheats on user(s)", ULib.ACCESS_ADMIN, "!cheats", _, ulx.ID_PLAYER_HELP ) -- I admit, I just copypasted these.
ulx.addToMenu( ulx.ID_MCLIENT, "cheats", "ulx cheats" )

You get the idea even if you don't use ULX. It's quite helpful.

[tehbiga]

[QUOTE=Lap;16266974]That's like saying I shouldn't bother using my foot to kill an ant since this rocket launcher I use takes care of everything. The rocket launcher is just a lazy solution that is total overkill.[/QUOTE]

This. I don't see much of a problem with this update except that it is [b]un-announced, [i]LIKE HALF THE SHIT THAT GETS CHANGED[/i].[/b]

[FPtje]

Why not make a blacklist instead of a whitelist?

I mean, the commands that have to be blocked are bind, unbind togglebind and that kind of shit.