Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Limit permissions of "map" resource type #3952

Open
1 task done
CArg22 opened this issue Jan 12, 2025 · 3 comments
Open
1 task done

Limit permissions of "map" resource type #3952

CArg22 opened this issue Jan 12, 2025 · 3 comments
Labels
enhancement New feature or request

Comments

@CArg22
Copy link
Contributor

CArg22 commented Jan 12, 2025

Is your feature request related to a problem? Please describe.

You can put non-map code inside "map" resource type. It is often used to hide malicious code.

Describe the solution you'd like

Add to mtaserver.conf option to globally limit what this kind of resources can do to bare minimum. Even if acl allow, map resource will be very strict what can be run inside it. Make it not able to run more code, to interact with rest of the server.

Describe alternatives you've considered

No response

Additional context

No response

Security Policy

  • I have read and understood the Security Policy and this issue is not about a cheat or security vulnerability.
@CArg22 CArg22 added the enhancement New feature or request label Jan 12, 2025
@botder
Copy link
Member

botder commented Jan 12, 2025

And how should we determine whether a function is dangerous or not?

@Fernando-A-Rocha
Copy link
Contributor

Sadly map resources still include scripts for LOD and remove world object...

@CArg22
Copy link
Contributor Author

CArg22 commented Jan 19, 2025

And how should we determine whether a function is dangerous or not?

Every function, even block all functions and those scripts to load LOD move to c++

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

3 participants