Zandronum Chat on our Discord Server Get the latest version: 3.2
Source Code
My View | View Issues | Change Log | Roadmap | Zandronum Issue Support Ranking | Rules | My Account
  

View Issue Details [ Jump to Notes ] [ Issue History ] [ Print ]
IDProjectCategoryView StatusDate SubmittedLast Update
0002554Zandronum[All Projects] Suggestionpublic2015-12-21 22:302023-08-11 08:52
ReporterFused 
Assigned To 
PrioritynormalSeverityfeatureReproducibilityN/A
StatusclosedResolutiondenied 
PlatformOSOS Version
Product Version3.0-beta 
Target VersionFixed in Version 
Summary0002554: New ACS functions for server administration
DescriptiongetPlayerIP(PlayerNumber())
forcespecPlayer / kickPlayer(PlayerNumber(), reason)
mutePlayer(PlayerNumber(), length)
banPlayer(PlayerNumber() / IP, length, reason)

These new functions allow mods to manually punish people for doing something they are not meant to do without having to change the server itself.

These functions can be very helpful, as they can for example ban people who ragespectate in Zombie Horde much like Kpatch used to do in Grandvoid.
Right now moderators can't do anything about it unless they check it out themselves, which can be annoying or in ZH's case near impossible if they are not around.

I realise this is discouraged, but please consider adding this in in some way for developers to use. Having a feature like this can really help preventing people from rule-breaking.
Attached Files

- Relationships
related to 0002593acknowledgedDusk Improvements to the RCON protocol 
related to 0004153resolved Provide a way to apply (mild) timed bans on players through ACS 

-  Notes
User avatar (0014010)
StrikerMan780 (reporter)
2015-12-21 22:31
edited on: 2015-12-21 22:42

 This could be useful with the database and login system too. (Admin mod, anyone?)

For security, this would have to be made sure that these commands won't work from NET scripts puked by people who aren't considered an admin or didn't use "send_password" for RCON first.

Also, being able to manually specify an IP should not be allowed. Otherwise people will sneak in mods that'll ban specific people on servers they don't control directly. Bans should only be allowed to be 15 minutes max. It should only allow banning by player number, where the server itself will handle the rest (IP banning, etc).
User avatar (0014011)
Fused (reporter)
2015-12-21 22:39

 Sorry, but ForceSpecplayer is already included under the name KickFromGame. Ignore that one.
User avatar (0014012)
DrinkyBird (developer)
2015-12-21 22:47

 I don't agree with this because mod developers could sneak these in and use them to kick/ban/rtc when they shouldn't.

They could do something similar as Demy did with AOW 2.1; not include the source but have the scripts included in the compiled ACS object file. Despite Demy having RCon, it still would be possible using NET scripts and arguments.
User avatar (0014013)
Fused (reporter)
2015-12-21 22:55
edited on: 2015-12-21 23:11

 Then perhaps there could be a warning when something like this is included in a mod? Or perhaps include a flag to enable features like this on a server if it's supposed to be included?
User avatar (0014014)
Dusk (developer)
2015-12-21 23:13

 I'm still leaning towards a no but let's see where we go here.

Quote
Then perhaps there could be a warning when something like this is included in a mod? Or perhaps include a flag to enable features like this on a server if it's supposed to be included?

Cannot be done because a function call cannot be detected before it happens.
User avatar (0014015)
Leonard (developer)
2015-12-21 23:21

 It's the hoster's responsibility over what's being hosted.
Compiled ACS files can be abused in many ways already and if that's what your concern is, you should just use a trustable source for your mods or compile the acs sources yourself..
User avatar (0014016)
ibm5155 (reporter)
2015-12-21 23:53

 maybe, a way to request a server admin to do some action?
like,
RequestServerActionBan(int Player, str Reason);
RequestServerActionChangeMap(str Map, str Reason);

that show a message over the server console and also to the irc hoster like:
Some server from best-ever requested to change the map, because votemaps were disabled and also the map was broken, so the console log would receive something like "#MAPCHANGEREQUEST E1M2, E1M1 is broken", the irc Channel from BE could implemente a filter for server messages starting with #MAPCHANGEREQUEST so even the admins inside the irc channel could see the request.
User avatar (0014019)
ZzZombo (reporter)
2015-12-23 03:07

 WHat
User avatar (0014043)
Fused (reporter)
2016-01-05 13:13
edited on: 2016-01-05 13:26

 So I created a script of my Zombie Horde idea, that could be a nice example to showcase this. It's not complete, since the NET script can be puked by players, but this should work online if these features would be added.

'http://pastebin.com/nNynA9dh [^]'

notice line 31 and 49 where this would be used.
User avatar (0014044)
Visual Vincent (reporter)
2016-01-05 16:34
edited on: 2016-01-05 16:34

 Just a little note to ibm5155:
The map can already be changed via the "ChangeLevel" method:'http://zdoom.org/wiki/ChangeLevel [^]'
User avatar (0014054)
Arco (updater)
2016-01-07 01:44
edited on: 2016-01-07 02:05

 I don't necessarily think that a developer of a mod should have those features. It looks like a security vulnerability waiting to erupt.
User avatar (0014057)
Catastrophe (reporter)
2016-01-07 07:25

 How would automated moderation ever be a security vulnerability? All modern games have this in some form.
User avatar (0014058)
Arco (updater)
2016-01-07 22:40

 Sorry, I meant to say that GetPlayerIP itself may open up a client security vulnerability, as developers could find information on clients that they shouldn't have access to through their IP. I don't really think that a mod developer should concern themselves with administrative actions such as banning people, as it's chiefly the server host's responsibility to handle.
User avatar (0014059)
AlexMax (developer)
2016-01-08 03:05

 I am in inclined in favor of this, but only under the circumstance that these ACS functions return nothing at runtime by default unless the server administrator has specifically turned on a flag. Heck, maybe do something like make it a check against the string "Yes, I understand the risks of enabling this flag." instead of a simple true/false.

Without such a flag, count me as a strong - nay, an emphatic - rejection. It would be trivial for somebody to hide an administrative backdoor in their mod that would allow them to take control of any server the mod is running on. Simply compile the ACS source with the backdoor baked-in, then take it out of the SCRIPTS lump (or wherever you're storing the source) before you distribute it.

SourceMod gets around this issue by enforcing all scripts available on their site be distributed under the GPLv3, which requires source disclosure, and is something Zandronum cannot hope to enforce. Garry's Mod gets around this issue because Lua is distributed in source-form. There _must_ be a flag, or else you would be very foolish as a server administrator to run any mod with compiled ACS.
User avatar (0014060)
Monsterovich (reporter)
2016-01-08 10:35

 >banPlayer(PlayerNumber() / IP, length, reason)

I still remember ZH script that kicked (banned) me on every GV server, because I went to the spectators as the first zombie. Do not let modders to do that, seriously.

>kickPlayer(PlayerNumber(), reason)
The same. ^^^^

>forcespecPlayer
Already in.

>getPlayerIP(PlayerNumber())
This function can be very useful to detect players, because playerid and nickname are not the universal identifiers. Unlike ip they can be easily changed by reconnecting or renaming.
User avatar (0014061)
Fused (reporter)
2016-01-08 11:15
edited on: 2016-01-08 11:17

 > I still remember ZH script that kicked (banned) me on every GV server, because I went to the spectators as the first zombie. Do not let modders to do that, seriously.

Kpatch had this feature and it's the main reason I want this feature to be added. I don't really understand the reason you would not want this added though. Because now you're just implying you prefer to ruin the game for players instead of having a way to get them punished.

>getPlayerIP can be very useful to detect players, because playerid and nickname are not the universal identifiers. Unlike ip they can be easily changed by reconnecting or renaming.

That's very true. This could also work as a very nice way to get data from someone without using the login system.

All in all, I believe this could work out with AlexMax's suggestion. Perhaps there could even be a way to only enable this feature for certain scripts. That way it could only be abused if this script is replaced.
User avatar (0014062)
Catastrophe (reporter)
2016-01-08 14:15

 > I don't really think that a mod developer should concern themselves with administrative actions such as banning people, as it's chiefly the server host's responsibility to handle.

I agree - but it is also within the server host's right to allow automated moderation. I think the best compromise would be Alexmax's where the server host would have to enable a flag, lets call it sv_allowcustommoderation, to be able to register kick or ban commands from a mod such as Zombie Horde.
User avatar (0014063)
ibm5155 (reporter)
2016-01-08 17:31
edited on: 2016-01-08 17:31

 you could mark the player to be banned with a cvar, so a script running clientside could check that cvar if true, execute a command that will only crash that specific player.
But I think a better solution, is a punishment script, like, if a player rq as the first zombie, force he to start only with a pistol or with 20HP for 3 - 4 rounds.
User avatar (0014189)
Dusk (developer)
2016-01-24 20:35

 Closing after dev discussion. ACS has no place in server management. Instead, use the RCON protocol to do automated administrative tasks.

I recognize that the current state of RCON protocol makes it unreliable for automated services (at least remote ones anyway) and I hope to address this for 3.0.

Issue Community Support
This issue is already marked as resolved.
If you feel that is not the case, please reopen it and explain why.
Supporters: Catastrophe Leonard Hypnotoad Visual Vincent ibm5155 Ivan
Opponents: DrinkyBird Dusk Monsterovich

- Issue History
Date Modified Username Field Change
2015-12-21 22:30 Fused New Issue
2015-12-21 22:31 StrikerMan780 Note Added: 0014010
2015-12-21 22:36 StrikerMan780 Note Edited: 0014010 View Revisions
2015-12-21 22:37 StrikerMan780 Note Edited: 0014010 View Revisions
2015-12-21 22:39 Fused Note Added: 0014011
2015-12-21 22:42 StrikerMan780 Note Edited: 0014010 View Revisions
2015-12-21 22:47 DrinkyBird Note Added: 0014012
2015-12-21 22:55 Fused Note Added: 0014013
2015-12-21 23:11 Fused Note Edited: 0014013 View Revisions
2015-12-21 23:13 Dusk Note Added: 0014014
2015-12-21 23:14 Dusk Priority high => normal
2015-12-21 23:21 Leonard Note Added: 0014015
2015-12-21 23:53 ibm5155 Note Added: 0014016
2015-12-23 03:07 ZzZombo Note Added: 0014019
2016-01-05 13:13 Fused Note Added: 0014043
2016-01-05 13:21 Fused Note Edited: 0014043 View Revisions
2016-01-05 13:26 Fused Note Edited: 0014043 View Revisions
2016-01-05 16:34 Visual Vincent Note Added: 0014044
2016-01-05 16:34 Visual Vincent Note Edited: 0014044 View Revisions
2016-01-07 01:44 Arco Note Added: 0014054
2016-01-07 02:05 Arco Note Edited: 0014054 View Revisions
2016-01-07 07:25 Catastrophe Note Added: 0014057
2016-01-07 22:40 Arco Note Added: 0014058
2016-01-08 03:05 AlexMax Note Added: 0014059
2016-01-08 10:35 Monsterovich Note Added: 0014060
2016-01-08 11:15 Fused Note Added: 0014061
2016-01-08 11:17 Fused Note Edited: 0014061 View Revisions
2016-01-08 14:15 Catastrophe Note Added: 0014062
2016-01-08 17:31 ibm5155 Note Added: 0014063
2016-01-08 17:31 ibm5155 Note Edited: 0014063 View Revisions
2016-01-24 20:35 Dusk Note Added: 0014189
2016-01-24 20:35 Dusk Status new => closed
2016-01-24 20:35 Dusk Resolution open => denied
2016-01-24 21:08 Dusk Relationship added related to 0002593
2023-08-11 08:52 Kaminsky Relationship added related to 0004153




Questions or other issues? Contact Us.

Links

Copyright © 2000 - 2025 MantisBT Team
Powered by Mantis Bugtracker