Global materials exploit?

MINIMAN10000: no no lua
MINIMAN10000: just change the color of a material
MINIMAN10000: and it will change the color of all of those materials

178 “MINIMAN10000” STEAM_0:0:15177157 1:58:58 106 0 active

This person is able to change the material for everyone on the server to any color. For example, he colored the skybox and all props, as well as little icons I put into chat. I am doubtful it is because of some exploit in my lua.

Are you 100% sure about that?

There are certain map materials that if you apply them to props and colorise the props the world material will change too.


@persist List:array I Total



if(first()) {
List:pushString("brick/brickwall003a")
List:pushString("nature/blendgrassgrass001a")
List:pushString("concrete/concretefloor011a")
List:pushString("concrete/concretefloor033o")

Total=List:count()
I=1
timer("hell",1000)
}

if(clk("hell")) {
   # print(List[I,string])
    entity():setMaterial(List[I,string])
    entity():setColor(vec(0,0,0),1)
    I++
    timer("hell",1)
}
if(I>Total) { reset() }


#Sets all materials in List to transparent until gmod is reset.
#I cam across this one day when messing with materials.

This is an e2 that will work, however it can easily be done without an e2.

oh christ old posts please burn me in a fire

This is why you block shit like setMaterial.

I never would have thought of that exploit.

Yup. It is no lua. Just set mat of prop and change its colour.

Am I the only one in this thread that realises this is possible because you give clients access to entity.Set Material and SetColor on the server?

Normal material and color tool can do this.
Garry hasn’t either notices my mails of this bug or just hasn’t cared enough.

Material and Color STOOL are default tools in gmod sandbox server.

Maybe check if the vmt can’t be applied to models? I’m sure you could blacklist shaders and whatnot from the stool.

Except they don’t let you color the world.

Well then, I guess they do. That’s kind of retarded.

(Now I know what it feels like to be Cubar!)

They can. You just need to assign the correct material to a prop and you can colorize the world :\

With the toolgun?

I find that doubtful.

[editline]27th October 2010[/editline]

Whelp, looks like you can just set material_override to anything you want.

Still don’t see how it could change the world though, unless you need to spam it.

Put material on a prop then colorize it, it will color everything using that material, it doesnt work on all materials though

This bug has been around for ages.
The only way you could fix it is to blacklist certain materials.

[editline]27th October 2010[/editline]

It’s as simple as sticking it on a prop and colourising it.

[editline]27th October 2010[/editline]

E2 isn’t the problem here, it’s the source engine being dumb.

[editline]27th October 2010[/editline]

Unless you can check exactly what type of geometry the material expects to be applied to and prevent people from using ones that are supposed to be applied to world geometry / supposed to be used only in vgui, there is no way of fixing this.

All you’ve done by making the thread is make it so more people know about this exploit.
Thanks, I can see my server’s banlist growing…

It was…inevitable.
Plus now we might get it actually fixed. All you would really have to do is blacklist certain shaders from SetMaterial though…

Easier said than done.

Override SetMaterial shared, make a table of shaders not allowed, read the vmt with KeyValuesToTable(file.Read(“materials/mymaterial.vmt”, true)) (I’m pretty sure you can read vmt files), check if the shader is blacklisted and don’t call the old SetMaterial function, else call the old one.