From fe1827f5e4d1549df84d84e910117080b30427cd Mon Sep 17 00:00:00 2001 From: Alibek Omarov Date: Tue, 2 Jun 2026 06:13:59 +0500 Subject: [PATCH] engine: common: don't let executing @ prefixed commands and cvars for unprivileged mode --- engine/common/cmd.c | 2 +- engine/common/cvar.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/engine/common/cmd.c b/engine/common/cmd.c index b0bcca4b..075eea0e 100644 --- a/engine/common/cmd.c +++ b/engine/common/cmd.c @@ -834,7 +834,7 @@ static qboolean Cmd_ShouldAllowCommand( cmd_t *cmd, qboolean isPrivileged ) return true; // never allow local only commands from remote - if( FBitSet( cmd->flags, CMD_PRIVILEGED )) + if( FBitSet( cmd->flags, CMD_PRIVILEGED ) || cmd->name[0] == '@' ) return false; // allow engine commands if user don't mind diff --git a/engine/common/cvar.c b/engine/common/cvar.c index 8ddfc3f1..6ff28669 100644 --- a/engine/common/cvar.c +++ b/engine/common/cvar.c @@ -943,7 +943,7 @@ static qboolean Cvar_ShouldSetCvar( convar_t *v, qboolean isPrivileged ) if( isPrivileged ) return true; - if( FBitSet( v->flags, FCVAR_PRIVILEGED )) + if( FBitSet( v->flags, FCVAR_PRIVILEGED ) || v->name[0] == '@' ) return false; if( cl_filterstuffcmd.value <= 0.0f )