BastiaanandClaude Opus 5.5 8e7ac3c872 Pick a long bracket the json does not close in rcon commands (#506) ...

exp_reports, exp_roles and exp_groups wrapped the json they send to Lua in
a fixed [=[ ]=] long bracket. A report reason, role name or group name
containing ]=] closed it early and the rest ran as Lua through /sc. Any
player can make a report, so any player could run code on the server.

Use the next level the json does not contain, like the other plugins do.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-15 17:07:47 +01:00

..

module

Format names of players who never joined the instance

2026-09-26 23:22:18 +00:00

controller.test.js

Write plugins without state shared elsewhere as functions (#492)

2026-10-13 21:50:15 +01:00

instance.test.js

Pick a long bracket the json does not close in rcon commands (#506)

2026-10-15 17:07:47 +01:00

messages.test.js

Move exp_reports to ES modules and declare its permissions

2026-09-26 23:22:18 +00:00

module.test.js

Move exp_reports to ES modules and declare its permissions

2026-09-26 23:22:18 +00:00