[^SmileY]

@HamletEagle

Yes, i never used even for a ban menu anyway.
Also i already have been seen such infected servers in action.

About Re-HLDS can be infected or how is going the updates of the server?

Ps. I really know what messagemode does for ban menus, but:

1. Register /ban <reason> command in say / say_team
2. When select an option in menu, reason is already in a variable.

Anyway any update is welcome too.

[fysiks]

Originally Posted by ^SmileY About Re-HLDS can be infected or how is going the updates of the server?

The vulnerability mentioned in the article is in the client, not the server. If there is some patch for the server too then it's not as important as the client and is the reason why you only download this stuff from the official source (aka Valve) which is one reason to not use ReHLDS.

[Solokiller]

The messagemode and messagemode2 commands were explicitly flagged as privileged. You're not getting those back because they're part of an attack vector for exploits.

[CrazY.]

It's not the end of the world, not sure why people are so worried.

[wOOw]

Seems like messagemode is working again after new Update ( 2019-03-22 )

[Solokiller]

The messagemode and messagemode2 commands are now no longer marked as privileged.

[meTaLiCroSS]

Originally Posted by Solokiller The messagemode and messagemode2 commands are now no longer marked as privileged.

Do you know which commands are marked as privileged?

[Solokiller]

Originally Posted by meTaLiCroSS Do you know which commands are marked as privileged?

Unfortunately there is no complete list, but you can query the engine's cvar and command functions lists to check for the flags.

For cvars flag 1024 indicates that it is privileged.
Flag 2048 indicates that it is a cl_filterstuffcmd privileged cvar, meaning if cl_filterstuffcmd is turned on it will act as a privileged cvar, but will otherwise be treated as a normal cvar.

For commands flag 8 indicates that it is privileged.
Flag 16 indicates that it is a cl_filterstuffcmd privileged command, which works the same way cvars do.

messagemode and messagemode2 are no longer privileged, but using the commands will mark the resulting message type as privileged depending on whether the command that set the type was privileged or not.

[edon1337]

Originally Posted by Solokiller Unfortunately there is no complete list, but you can query the engine's cvar and command functions lists to check for the flags. For cvars flag 1024 indicates that it is privileged. Flag 2048 indicates that it is a cl_filterstuffcmd privileged cvar, meaning if cl_filterstuffcmd is turned on it will act as a privileged cvar, but will otherwise be treated as a normal cvar. For commands flag 8 indicates that it is privileged. Flag 16 indicates that it is a cl_filterstuffcmd privileged command, which works the same way cvars do. messagemode and messagemode2 are no longer privileged, but using the commands will mark the resulting message type as privileged depending on whether the command that set the type was privileged or not.

Do you mind explaining what the difference between a privileged and unprivileged CVAR is?

[Solokiller]

Privileged cvars and commands should only be executed by the client, unprivileged ones can be executed by the remote server as well as the client. In practice it's a bit different since they bolted this on 20 years after the fact, so some commands will be treated differently.

For example for TFC only the server can execute exec commands, exec itself is privileged and will execute as a filtered command but the commands parsed from cfg files will be executed as regular commands. This causes another bug: https://github.com/ValveSoftware/halflife/issues/2112