[p3tsin]

Originally Posted by psychonic While that method probably works, it should not be publicized as it allows running any command on clients, effectively exploiting them, working around other checks in place limiting you from doing so.

I thought valve fixed that exploit ages ago

@LumiStance: no need for a packet sniffer. Just dump the contents of a VGUIMenu usermessage (the motd one) and you'll figure it out.

[LumiStance]

Censorship at its finest. You should delete SourceMod while you are at it.

[psychonic]

Originally Posted by p3tsin I thought valve fixed that exploit ages ago

They only first it for redirecting players (the connect commands).

Originally Posted by p3tsin @LumiStance: no need for a packet sniffer. Just dump the contents of a VGUIMenu usermessage (the motd one) and you'll figure it out.

He did already figure it out. That's what was removed.

Originally Posted by LumiStance Censorship at its finest. You should delete SourceMod while you are at it.

The use you had was fully legitimate, but the method you used can be used to exploit clients, which we don't support here. Running most commands on clients is already purposely blocked in most games, and running the ones that each game allows is already supported.

[LumiStance]

How would I know if a method is not allowed to be posted here?

I haven't gone out and researched how to exploit CSS. Were these on a rogue server, or are there some serious vulnerabilities that allow a player to make changes to another players computer, in areas outside of steam?

I'm also confused why a server redirecting a client would be considered an exploit. Web servers do this all of the time.

[devicenull]

Valve removed the ability to directly redirect clients, so anything that works around this block is an exploit.

Value removed the ability to execute commands on clients, so anything that works around this block is an exploit.

The code to send custom motd's is very close to the exploit code, and won't be allowed.

[Marley]

Surely the easiest way would be to have a php page as the url, and send the data needed via params in a url?

[LumiStance]

devicenull, I was not aware that valve has been removing functionality, nor was I aware that legitimate workarounds are not allowed.

Is there a list of things I should avoid (I didn't see these items in http://forums.alliedmods.net/misc.php?do=showrules), or do I just hope that I don't anger the gods with my actions?

Marley, that's the easy part.