{"action":"created","issue":{"url":"https://api.github.com/repos/mvdevs/jk2mv/issues/46","labels_url":"https://api.github.com/repos/mvdevs/jk2mv/issues/46/labels{/name}","comments_url":"https://api.github.com/repos/mvdevs/jk2mv/issues/46/comments","events_url":"https://api.github.com/repos/mvdevs/jk2mv/issues/46/events","html_url":"https://github.com/mvdevs/jk2mv/issues/46","id":107632366,"number":46,"title":"Plenty of exploits and fixes missing from OpenJK/ioquake3","user":{"login":"ensiform","id":997399,"avatar_url":"https://avatars.githubusercontent.com/u/997399?v=3","gravatar_id":"","url":"https://api.github.com/users/ensiform","html_url":"https://github.com/ensiform","followers_url":"https://api.github.com/users/ensiform/followers","following_url":"https://api.github.com/users/ensiform/following{/other_user}","gists_url":"https://api.github.com/users/ensiform/gists{/gist_id}","starred_url":"https://api.github.com/users/ensiform/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ensiform/subscriptions","organizations_url":"https://api.github.com/users/ensiform/orgs","repos_url":"https://api.github.com/users/ensiform/repos","events_url":"https://api.github.com/users/ensiform/events{/privacy}","received_events_url":"https://api.github.com/users/ensiform/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/mvdevs/jk2mv/milestones/2","html_url":"https://github.com/mvdevs/jk2mv/milestones/Version%201.1","labels_url":"https://api.github.com/repos/mvdevs/jk2mv/milestones/2/labels","id":1089705,"number":2,"title":"Version 1.1","description":"Milestone for the v1.1 release","creator":{"login":"ouned","id":9250728,"avatar_url":"https://avatars.githubusercontent.com/u/9250728?v=3","gravatar_id":"","url":"https://api.github.com/users/ouned","html_url":"https://github.com/ouned","followers_url":"https://api.github.com/users/ouned/followers","following_url":"https://api.github.com/users/ouned/following{/other_user}","gists_url":"https://api.github.com/users/ouned/gists{/gist_id}","starred_url":"https://api.github.com/users/ouned/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ouned/subscriptions","organizations_url":"https://api.github.com/users/ouned/orgs","repos_url":"https://api.github.com/users/ouned/repos","events_url":"https://api.github.com/users/ouned/events{/privacy}","received_events_url":"https://api.github.com/users/ouned/received_events","type":"User","site_admin":false},"open_issues":5,"closed_issues":12,"state":"open","created_at":"2015-04-29T17:55:05Z","updated_at":"2015-09-24T18:13:35Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2015-09-22T02:02:01Z","updated_at":"2015-09-28T20:36:24Z","closed_at":null,"body":"When I have time to crawl through more, I can start showing which things exactly.\r\n\r\n- [ ] Challenge spoofing from servers to redirect clients to proxy servers\r\n- [ ] Client side download code workaround for larger downloads\r\n- [ ] Cheat cvars aren't protected as well as in OpenJK and ioquake3 (on client connect)\r\n- [ ] sv_cheats can just be initialized to 1 in the engine and reset to 1 upon server disconnect on the client as well.  This allows clients to use cheat cvars during demo playback instead of the current workaround.\r\n- [ ] Is there any particular reason why systeminfo cvars aren't protected better on the client like this? - https://github.com/JACoders/OpenJK/blob/master/codemp/client/cl_parse.cpp#L467-L489\r\n- [x] Not all cases of dir traversal appear fixed\r\n- [ ] __LACKING BUFFER SAFETY EVERYWHERE__ with vsprintf instead of Q_vsnprintf can't fix broken mods still using it either and non-use of \"%s\" before printing strings in several areas.\r\n- [ ] Servers can send download packets to clients who don't even request\r\n- [ ] Rcon code doesn't work with quotes and spaces properly on client or server\r\n- [ ] Rcon code is not buffer safe on client\r\n- [ ] Anyone can send print packets to clients"},"comment":{"url":"https://api.github.com/repos/mvdevs/jk2mv/issues/comments/143866601","html_url":"https://github.com/mvdevs/jk2mv/issues/46#issuecomment-143866601","issue_url":"https://api.github.com/repos/mvdevs/jk2mv/issues/46","id":143866601,"user":{"login":"ensiform","id":997399,"avatar_url":"https://avatars.githubusercontent.com/u/997399?v=3","gravatar_id":"","url":"https://api.github.com/users/ensiform","html_url":"https://github.com/ensiform","followers_url":"https://api.github.com/users/ensiform/followers","following_url":"https://api.github.com/users/ensiform/following{/other_user}","gists_url":"https://api.github.com/users/ensiform/gists{/gist_id}","starred_url":"https://api.github.com/users/ensiform/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ensiform/subscriptions","organizations_url":"https://api.github.com/users/ensiform/orgs","repos_url":"https://api.github.com/users/ensiform/repos","events_url":"https://api.github.com/users/ensiform/events{/privacy}","received_events_url":"https://api.github.com/users/ensiform/received_events","type":"User","site_admin":false},"created_at":"2015-09-28T20:36:24Z","updated_at":"2015-09-28T20:36:24Z","body":"Added more things."}}