Two halves. The first is four defects found while working across the family, each re-derived against Episode 2.1.5’s own server before anything here was touched, because a fix that is right for another episode is not evidence for this one. The second half is shared work from Golden Age v0.3.1 that arrives here by being shared.
Fixed In The Game
- The banker never answered whether a trunk costs anything. The client asks on approach and got silence, so the answer it acted on was whatever it assumed.
- A failed loot pickup replied with a full record. The original sends the error code alone and never even fills in the other eighteen bytes.
- The anti-speedhack check started at the wrong moment. It was armed when the character entered the world; the original arms it earlier, at the point of entering the account, from its only call site.
- Revoking a staff level did nothing until that player logged out. Their level was read once when their character entered the world, so the only way to disarm a compromised staff account was to stop the server. It is now read on every command they type.
Backported From Golden Age v0.3.1
- The website that ships with the server has an admin area. Sign in with an account that holds a staff level and there is an Admin link in the header, with the server’s live state and the staff list behind it. It opens at Administrator; handing out levels needs Super Administrator.
- Five staff levels, granted per account and per game. Player, Moderator, Game Master, Administrator and Super Administrator. GM Accounts covers the model.
- A way to make your first administrator on a fresh server. The website prints a one time
password in the console and writes it to
SUPER_PASSWORDinsettings.cfg. Sign in with any email address and that password in place of the real one, and that account becomes a Super Administrator. It is single use, blanked the moment it is used, and only generated while nobody holds the top level. tools/gmadminin the archive. Lists staff, searches accounts, creates them, sets passwords, grants and revokes levels, and deletes accounts. It works with the server stopped and needs nothing installed.- Sign in is rate limited, per address and per account, and a failed sign in no longer takes a different amount of time depending on whether the email is registered.
What You Should Act On
- The built in
[email protected]account no longer ships with staff powers. Its password is published in our source and in every copy of this archive, so it was an administrator anybody who downloaded the server already knew the password to. Grant your own account a level before you upgrade, or use the bootstrap password above. - A zero length
settings.cfgis now an error instead of being read as every setting at its default, which quietly pointed a server at the wrong database.
What Is Not Here Yet
- Staff commands in game are still all or nothing on this episode. Any account with any grant runs every command. Golden Age enforces a level per command.
- The panel’s server settings page is empty here, and its server controls report that this build has no control channel. Both are accurate: editable rates and the reload, announce and shutdown operations exist only on Golden Age so far, and the panel says so.