Created attachment 1852[details]
My implementation
This is functionally more or less identical but IMO neater than both patches above. Might be slightly slower, but I may or may not submit further largely unrelated patches that make the command or cvar code a little more efficient.
Created attachment 1853[details]
More paranoid version of the above
This patch is the same, but instead of merely informing the user via a print, the system drops the client from the server if a QVM tries to do something malicious.
This should make servers that distribute dangerous QVMs very easy to spot, and if you're running a QVM that does this kind of thing you probably don't want to keep running it anyway.
I think it may still be possible to set variables by using trap_Cvar_Register to add the CVAR_USER_CREATED flag, then calling it again with CVAR_ROM.
Also, although it's rarer for servers to run untrusted QVMs, the possibility should probably be addressed.
I will address both these issues in a new patch sometime later.
Created attachment 1854[details]
Tighter security
This patch prohibits using Cvar_Get to add CVAR_USER_CREATED to an already-existing variable, which should close the security hole with trap_Cvar_Register
It also adds protection to sv_game.c which I omitted the first time.
Created attachment 1857[details]
Issues above addressed
Sorted the issues above and switched to more logical naming since server var setting is now protected.
Also, disallowed setting CVAR_SERVER_CREATED on existing variable with Cvar_Get.
Created attachment 1852 [details] My implementation This is functionally more or less identical but IMO neater than both patches above. Might be slightly slower, but I may or may not submit further largely unrelated patches that make the command or cvar code a little more efficient.Created attachment 1853 [details] More paranoid version of the above This patch is the same, but instead of merely informing the user via a print, the system drops the client from the server if a QVM tries to do something malicious. This should make servers that distribute dangerous QVMs very easy to spot, and if you're running a QVM that does this kind of thing you probably don't want to keep running it anyway.Created attachment 1854 [details] Tighter security This patch prohibits using Cvar_Get to add CVAR_USER_CREATED to an already-existing variable, which should close the security hole with trap_Cvar_Register It also adds protection to sv_game.c which I omitted the first time.Created attachment 1855 [details] Whoops. Above patch doesn't compile :( fixedCreated attachment 1857 [details] Issues above addressed Sorted the issues above and switched to more logical naming since server var setting is now protected. Also, disallowed setting CVAR_SERVER_CREATED on existing variable with Cvar_Get.