All forum data (this website) will be deleted unless you vote to keep the forum.

Security issue with Null player names

Discussion in 'Help and Support' started by zechnophobe, Feb 18, 2020.

  1. zechnophobe

    zechnophobe Level 0

    Joined:
    Feb 18, 2020
    Messages:
    1
    Hello, I had a character join my server which generated this log entry:

    (dudes.ip.address.ok) from 'guest' group joined. (11/20)

    The start of that line *is* their character name, it's just whitespace characters or something. Showed up in the logs as 'NUL NUL'

    I believe that when this happened it nuked my superadmins ability to send commands to tshock. Command line commands were ignored as well as in game ones, and we had to kill the service.

    Is this a vulnerability of tshock? Is there some way to work around it? (Besides aggressive white-listing)?

    Any help would be appreciated.
     
  2. TheLastPrism

    TheLastPrism Level 0

    Joined:
    Jul 15, 2019
    Messages:
    4
    Try using player's index.
    You can use /who -i to get players' indexes.