Make chat get the author username serverside
storm37000 opened this issue · 2 comments
storm37000 commented
Major security issue that modders are exploiting, they can impersonate any username by just sending that username since you trust them to provide that data properly.
blattersturm commented
No. It's not even a 'security issue', it's a by-design API feature.
storm37000 commented
im talking about where in the chat window and the console it gets the string for who sent the message. Ive actually seen hackers use this to make it fully appear that somebody else was saying things they werent. This has nothing to do with the API, this is an issue with the chat resource. Ive already patched this security hole on my server, let me know if you want a pr.