add a note that for secure rcon, client and server clocks need to be synced

[xonotic/darkplaces.git] / host_cmd.c

diff --git a/host_cmd.c b/host_cmd.c
index 6c051d9f0f8c0e83cc9715560619d9c83d2a8a1d..053c5581c5aa38bbf402e8a2955bf2213d9bddde 100644 (file)
--- a/host_cmd.c
+++ b/host_cmd.c
@@ -32,8 +32,8 @@ cvar_t sv_cheats = {0, "sv_cheats", "0", "enables cheat commands in any game, an
 cvar_t sv_adminnick = {CVAR_SAVE, "sv_adminnick", "", "nick name to use for admin messages instead of host name"};
 cvar_t sv_status_privacy = {CVAR_SAVE, "sv_status_privacy", "0", "do not show IP addresses in 'status' replies to clients"};
 cvar_t sv_status_show_qcstatus = {CVAR_SAVE, "sv_status_show_qcstatus", "0", "show the 'qcstatus' field in status replies, not the 'frags' field. Turn this on if your mod uses this field, and the 'frags' field on the other hand has no meaningful value."};
-cvar_t rcon_password = {CVAR_PRIVATE, "rcon_password", "", "password to authenticate rcon commands"};
-cvar_t rcon_secure = {0, "rcon_secure", "1", "force secure rcon authentication"};
+cvar_t rcon_password = {CVAR_PRIVATE, "rcon_password", "", "password to authenticate rcon commands; NOTE: changing rcon_secure clears rcon_password, so set rcon_secure always before rcon_password"};
+cvar_t rcon_secure = {CVAR_NQUSERINFOHACK, "rcon_secure", "0", "force secure rcon authentication; NOTE: changing rcon_secure clears rcon_password, so set rcon_secure always before rcon_password"};
 cvar_t rcon_address = {0, "rcon_address", "", "server address to send rcon commands to (when not connected to a server)"};
 cvar_t team = {CVAR_USERINFO | CVAR_SAVE, "team", "none", "QW team (4 character limit, example: blue)"};
 cvar_t skin = {CVAR_USERINFO | CVAR_SAVE, "skin", "", "QW player skin name (example: base)"};
@@ -473,11 +473,7 @@ void Host_Reconnect_f (void)
                // will still contain its IP address, so get the address...
                InfoString_GetValue(cls.userinfo, "*ip", temp, sizeof(temp));
                if (temp[0])
-               {
-                       // clear the rcon password, to prevent vulnerability by stuffcmd-ing a setinfo command to change *ip, then reconnect
-                       Cvar_SetQuick(&rcon_password, "");
                        CL_EstablishConnection(temp);
-               }
                else
                        Con_Printf("Reconnect to what server?  (you have not connected to a server yet)\n");
                return;
@@ -530,7 +526,8 @@ void Host_Connect_f (void)
                return;
        }
        // clear the rcon password, to prevent vulnerability by stuffcmd-ing a connect command
-       Cvar_SetQuick(&rcon_password, "");
+       if(!rcon_secure.integer)
+               Cvar_SetQuick(&rcon_password, "");
        CL_EstablishConnection(Cmd_Argv(1));
 }
 
@@ -990,22 +987,30 @@ void Host_Name_f (void)
 {
        int i, j;
        qboolean valid_colors;
+       const char *newNameSource;
        char newName[sizeof(host_client->name)];
 
        if (Cmd_Argc () == 1)
        {
-               Con_Printf("\"name\" is \"%s\"\n", cl_name.string);
+               Con_Printf("name: %s\n", cl_name.string);
                return;
        }
 
        if (Cmd_Argc () == 2)
-               strlcpy (newName, Cmd_Argv(1), sizeof (newName));
+               newNameSource = Cmd_Argv(1);
        else
-               strlcpy (newName, Cmd_Args(), sizeof (newName));
+               newNameSource = Cmd_Args();
+
+       strlcpy(newName, newNameSource, sizeof(newName));
 
        if (cmd_source == src_command)
        {
                Cvar_Set ("_cl_name", newName);
+               if (strlen(newNameSource) >= sizeof(newName)) // overflowed
+               {
+                       Con_Printf("Your name is longer than %i chars! It has been truncated.\n", (int) (sizeof(newName) - 1));
+                       Con_Printf("name: %s\n", cl_name.string);
+               }
                return;
        }
 
@@ -2390,7 +2395,7 @@ void Host_Rcon_f (void) // credit: taken from QuakeWorld
        if (mysocket)
        {
                // simply put together the rcon packet and send it
-               if(rcon_secure.integer)
+               if(Cmd_Argv(0)[0] == 's' || rcon_secure.integer)
                {
                        char buf[1500];
                        char argbuf[1500];
@@ -2785,7 +2790,8 @@ void Host_InitCommands (void)
        Cvar_RegisterVariable (&rcon_password);
        Cvar_RegisterVariable (&rcon_address);
        Cvar_RegisterVariable (&rcon_secure);
-       Cmd_AddCommand ("rcon", Host_Rcon_f, "sends a command to the server console (if your rcon_password matches the server's rcon_password), or to the address specified by rcon_address when not connected (again rcon_password must match the server's)");
+       Cmd_AddCommand ("rcon", Host_Rcon_f, "sends a command to the server console (if your rcon_password matches the server's rcon_password), or to the address specified by rcon_address when not connected (again rcon_password must match the server's); note: if rcon_secure is set, client and server clocks must be synced e.g. via NTP");
+       Cmd_AddCommand ("srcon", Host_Rcon_f, "sends a command to the server console (if your rcon_password matches the server's rcon_password), or to the address specified by rcon_address when not connected (again rcon_password must match the server's); this always works as if rcon_secure is set; note: client and server clocks must be synced e.g. via NTP");
        Cmd_AddCommand ("user", Host_User_f, "prints additional information about a player number or name on the scoreboard");
        Cmd_AddCommand ("users", Host_Users_f, "prints additional information about all players on the scoreboard");
        Cmd_AddCommand ("fullserverinfo", Host_FullServerinfo_f, "internal use only, sent by server to client to update client's local copy of serverinfo string");