Index: code/client/cl_keys.c
===================================================================
--- code/client/cl_keys.c	(revision 1802)
+++ code/client/cl_keys.c	(working copy)
@@ -583,14 +583,28 @@
 
 	// enter finishes the line
 	if ( key == K_ENTER || key == K_KP_ENTER ) {
-		// if not in the game explicitly prepend a slash if needed
-		if ( cls.state != CA_ACTIVE && g_consoleField.buffer[0] != '\\' 
-			&& g_consoleField.buffer[0] != '/' ) {
+		// If not in the game explicitly prepend a slash if needed.
+		// Rambetter might recommend removing this feature.  Take the following scenario.
+		// The player types "rconpassword foofoo" (without preceding slash) while not connected.
+		// This changes the rconpassword.  Then the player connects and types the same thing.
+		// Oops!  The rconpassword is leaked!  This has happened many times on many servers.
+		// Think of a good way to prevent that.  Not treating strings as commands if they don't
+		// start with a slash would be consistent and safe.  That is the way to go I think.
+		if ( cls.state != CA_ACTIVE &&
+				g_consoleField.buffer[0] && // don't add empty line to history
+				g_consoleField.buffer[0] != '\\' 
+				&& g_consoleField.buffer[0] != '/' ) {
+
 			char	temp[MAX_EDIT_LINE-1];
 
+			// Bug: This drops the last character from the command buffer if it's at capacity.
 			Q_strncpyz( temp, g_consoleField.buffer, sizeof( temp ) );
 			Com_sprintf( g_consoleField.buffer, sizeof( g_consoleField.buffer ), "\\%s", temp );
-			g_consoleField.cursor++;
+			if (g_consoleField.cursor < MAX_EDIT_LINE - 1) {
+				g_consoleField.cursor++;
+			}
+			// Otherwise we dropped last character in the command buffer and the
+			// cursor is at the end of the line, so don't increment cursor.
 		}
 
 		Com_Printf ( "]%s\n", g_consoleField.buffer );