Two halves. The first is three defects found while working across the family, each re-derived against Episode 2.1.6’s own server before anything here was touched, because a fix that is right for another episode is not evidence for this one. The second half is shared work from Golden Age v0.3.1 that arrives here by being shared.
Fixed In The Game
- The anti-speedhack exchange started twice and then stopped. The check was armed once at the lobby and again at world entry, against a single key. The second overwrote the first, the client’s answer to the first came back as a mismatch, and a mismatch does not restart the exchange, so it died within two frames of entering the world. The original arms it once, from one place. The test that was supposed to cover this passed with the bug present, because the spare challenge left over from the double arming satisfied exactly the thing it was checking.
- The banker never answered whether a trunk costs anything. The client asks on approach and got silence, so the answer it acted on was whatever it assumed. This version has no capture to check against, so it was read out of its own server binary and the code says so.
- Revoking a staff level did nothing until that player logged out. Their level was read once when their character entered the world, so the only way to disarm a compromised staff account was to stop the server. It is now read on every command they type.
Backported From Golden Age v0.3.1
- The website that ships with the server has an admin area. Sign in with an account that holds a staff level and there is an Admin link in the header, with the server’s live state and the staff list behind it. It opens at Administrator; handing out levels needs Super Administrator.
- Five staff levels, granted per account and per game. Player, Moderator, Game Master, Administrator and Super Administrator. GM Accounts covers the model.
- A way to make your first administrator on a fresh server. The website prints a one time
password in the console and writes it to
SUPER_PASSWORDinsettings.cfg. Sign in with any email address and that password in place of the real one, and that account becomes a Super Administrator. It is single use, blanked the moment it is used, and only generated while nobody holds the top level. tools/gmadminin the archive. Lists staff, searches accounts, creates them, sets passwords, grants and revokes levels, and deletes accounts. It works with the server stopped and needs nothing installed.- Sign in is rate limited, per address and per account, and a failed sign in no longer takes a different amount of time depending on whether the email is registered.
What You Should Act On
- The built in
[email protected]account no longer ships with staff powers. Its password is published in our source and in every copy of this archive, so it was an administrator anybody who downloaded the server already knew the password to. Grant your own account a level before you upgrade, or use the bootstrap password above. - A zero length
settings.cfgis now an error instead of being read as every setting at its default, which quietly pointed a server at the wrong database.
What Is Not Here Yet
- Staff commands in game are still all or nothing on this episode. Any account with any grant runs every command. Golden Age enforces a level per command.
- The panel’s server settings page is empty here, and its server controls report that this build has no control channel. Both are accurate: editable rates and the reload, announce and shutdown operations exist only on Golden Age so far, and the panel says so.