Questionable security rights at 'user' level

[JamminR]

While helping another user here with his ULX not allowing console commands, I looked through my own groups.txt.
I've not edited groups.txt in months(years?) and the codebase change has made 2 backups for me.

However, looking at my current groups.txt "user" group access, it has several functions I'm not sure I'd want a user doing.
Now, I've not tried rebuilding from clean/scratch my groups.txt file yet, but, wanted to throw this out there.

Code: [Select]

"user"
{
"allow"
{
"_pw"
"ulx"
"ulx addadvert"
"ulx addcsayadvert"
"ulx addforceddownload"
"ulx addgimpsay"
"ulx asay"
"ulx debuginfo"
"ulx help"
"ulx helpme"
"ulx logchat"
"ulx logdir"
"ulx logecho"
"ulx logevents"
"ulx logfile"
"ulx logspawns"
"ulx logspawnsecho"
"ulx menu"
"ulx motd"
"ulx psay"
"ulx thetime"
"ulx usermanagementhelp"
"ulx votebanminvotes"
"ulx votebansuccessratio"
"ulx voteecho"
"ulx votekickminvotes"
"ulx votekicksuccessratio"
"ulx votemap"
"ulx votemap2minvotes"
"ulx votemap2successratio"
"ulx votemapaddmap"
"ulx votemapenabled"
"ulx votemapmapmode"
"ulx votemapmintime"
"ulx votemapminvotes"
"ulx votemapsuccessratio"
"ulx votemapvetotime"
"ulx votemapwaittime"
"ulx who"
"ulx_cvar"
"ulx_getbans"
"ulx_getgamemodes"
"ulx_valueupdate"
}
}
Am I incorrect in presuming a 'user' on my server could set "ulx logevents" to 0/off?
(or any other of those commands I wouldn't want a user to do, addforceddownloads, adverts, any number of evil things)

[Megiddo]

Here's the current one:

Code: [Select]

"user"
{
"allow"
{
"ulx asay"
"ulx clientmenu"
"ulx help"
"ulx logchat"
"ulx logdir"
"ulx logecho"
"ulx logevents"
"ulx logfile"
"ulx logspawns"
"ulx logspawnsecho"
"ulx menu"
"ulx motd"
"ulx psay"
"ulx thetime"
"ulx usermanagementhelp"
"ulx votebanminvotes"
"ulx votebansuccessratio"
"ulx voteecho"
"ulx votekickminvotes"
"ulx votekicksuccessratio"
"ulx votemap"
"ulx votemap2minvotes"
"ulx votemap2successratio"
"ulx votemapenabled"
"ulx votemapmapmode"
"ulx votemapmintime"
"ulx votemapminvotes"
"ulx votemapsuccessratio"
"ulx votemapvetotime"
"ulx votemapwaittime"
"ulx who"
}
}
Yes, they have access to cvars. I'll be changing cvars soon though. (yes, again. I like our new command system, the current way was hackish).

[JamminR]

"How' soon Megiddo?
I'd hate for somethings to happen to tarnish the Ulysses name.
Sure, its SVN, but, I still consider that a large security exploit possibility not fully covered by "SVN = beta = use at your own risk"

[Megiddo]

Got of lot of stuff coming up, so probably within the next two weeks. Feel free to bug me about it.

[Stickly Man!]

*BUMP* Hate to do this, but.. This kinda is still a problem, as I pointed out to Megiddo yesterday

Mostly bumping to remind Megiddo

(Also, JamminR, the funnest thing to do with the cvars is set all of the votemap parameters to 0 (except ulx_votemapEnabled, of course)-- And now users have access to instant changemap!)

[jay209015]

*BUMP* Just to make sure Megiddo doesn't forget. Oh and it was irresistible not to bump, haven't done it in soo long.

[MrPresident]

*BUMP*

...

What? Everyone else was doing it!!!

[JamminR]

*BUMP*

...

What? Everyone else was doing it!!!

Absolutely!
*BUMP*
Everyone do the Bump!

[Megiddo]

I made a patch today while I was waiting for a file to extract at work, it'll be up when I get home.

[Stickly Man!]

Ok! 

Everybody was *bump*-foo fighting!! na-na-na-na naaa na na naaa!

[JamminR]

EU, Doing the bump, sexy sexy.
Oh. Wait. Wrong B word.

[Megiddo]

Bump, here's the new defaults:

Code: [Select]

"user"
{
"allow"
{
"ulx asay"
"ulx clientmenu"
"ulx help"
"ulx menu"
"ulx motd"
"ulx psay"
"ulx thetime"
"ulx usermanagementhelp"
"ulx votemap"
"ulx who"
}
}
"superadmin"
{
"allow"
{
"overcomeimmunity"
"ulx addgroup"
"ulx adduser"
"ulx adduserid"
"ulx cexec"
"ulx ent"
"ulx exec"
"ulx groupallow"
"ulx hiddenecho"
"ulx logchat"
"ulx logdir"
"ulx logecho"
"ulx logevents"
"ulx logfile"
"ulx logspawns"
"ulx logspawnsecho"
"ulx luarun"
"ulx maul"
"ulx rcon"
"ulx removegroup"
"ulx removeuser"
"ulx removeuserid"
"ulx renamegroup"
"ulx setgroupcantarget"
"ulx userallow"
"ulx voteecho"
}
"inherit_from" "admin"
}
"admin"
{
"can_target" "!%superadmin"
"allow"
{
"ulx adminmenu"
"ulx armor"
"ulx ban"
"ulx banid"
"ulx banmenu"
"ulx blind"
"ulx bring"
"ulx chattime"
"ulx cloak"
"ulx csay"
"ulx freeze"
"ulx gag"
"ulx gimp"
"ulx god"
"ulx goto"
"ulx hp"
"ulx ignite"
"ulx jail"
"ulx kick"
"ulx map"
"ulx mapsmenu"
"ulx mute"
"ulx noclip"
"ulx physgunplayer"
"ulx playsound"
"ulx ragdoll"
"ulx reservedslots"
"ulx rslots"
"ulx rslotsmode"
"ulx rslotsvisible"
"ulx send"
"ulx showmotd"
"ulx slap"
"ulx slay"
"ulx spawnecho"
"ulx spectate"
"ulx sslay"
"ulx strip"
"ulx teleport"
"ulx tsay"
"ulx unban"
"ulx unblind"
"ulx uncloak"
"ulx unfreeze"
"ulx ungag"
"ulx ungimp"
"ulx ungod"
"ulx unignite"
"ulx unigniteall"
"ulx unjail"
"ulx unmute"
"ulx unragdoll"
"ulx veto"
"ulx vote"
"ulx voteban"
"ulx votebanminvotes"
"ulx votebansuccessratio"
"ulx votekick"
"ulx votekickminvotes"
"ulx votekicksuccessratio"
"ulx votemap2"
"ulx votemap2minvotes"
"ulx votemap2successratio"
"ulx votemapenabled"
"ulx votemapmapmode"
"ulx votemapmintime"
"ulx votemapminvotes"
"ulx votemapsuccessratio"
"ulx votemapvetotime"
"ulx votemapwaittime"
"ulx welcomemessage"
"ulx whip"
"ups disableplayers"
"ups globaldisable"
"ups miscdeletionaccess"
"ups_damage"
"ups_freeze"
"ups_physgun"
"ups_remove"
"ups_tool"
"ups_unfreeze"
"ups_use"
"ups_vehicle"
}
"inherit_from" "operator"
}
"operator"
{
"can_target" "!%admin"
"allow"
{
"ulx seeasay"
}
"inherit_from" "user"
}

[Stickly Man!]

Bump around, bump around, bump around now-- bump up! bump up! get dowwn!

Oh.. I mean.. Awesome

Also, Megiddo, I wanted to pitch an idea where with every access string we include a type.. e.g. cmd, cvar, xgui (for my own) etc.. It would help for sorting things in XGUI later

[jay209015]

Bump around, bump around, bump around now-- bump up! bump up! get dowwn!

Oh.. I mean.. Awesome

Also, Megiddo, I wanted to pitch an idea where with every access string we include a type.. e.g. cmd, cvar, xgui (for my own) etc.. It would help for sorting things in XGUI later

     - I wouldn't personally suggest that in the configs, but if there were some function where you could pass the access string and it return a type that would be a different story.