-
Notifications
You must be signed in to change notification settings - Fork 2.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add Settings to in-game menu, and rewrite pause menu in Lua #14785
Conversation
Also exposes Lua's io functions to the client
Probably should add a method for changing the FOV but I am tired. This also works with /set fov ###, so not sure why something like this isn't done already.
Here's a version of rollerozxa's POC for the same thing, in case it's useful: grorp@a336186 and grorp@5600624 |
This is really hacky, but it demonstrates that everything works (kinda)
You can force reload graphics by showing the verbose debug page (press F5 a few times). It might be better to bind it to a specific keybind, but this was easier to implement and didn't require taking up another keybind.
…wireframe debug instead Still need to nuke the old FSTK settings pages and fix the main menu
@@ -85,6 +87,9 @@ void ClientScripting::InitializeModApi(lua_State *L, int top) | |||
ModApiChannels::Initialize(L, top); | |||
ModApiParticlesLocal::Initialize(L, top); | |||
ModApiClientSound::Initialize(L, top); | |||
|
|||
ModApiMainMenu::Initialize(L, top); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
the main menu api is completely unsecured, this is a no-go
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Will be removed soon. I don't believe this is needed.
NO_MAP_LOCK_REQUIRED; | ||
|
||
std::string path = porting::path_share + DIR_DELIM + "builtin" + DIR_DELIM; | ||
lua_pushstring(L, path.c_str()); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
leaks user paths to the secure client environment
{ | ||
g_gamecallback->exitToOS(); | ||
#ifndef __ANDROID__ | ||
RenderingEngine::get_raw_device()->closeDevice(); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
pretty sure the relevant code already calls this, why is this here?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You mean the android snippet?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
yes
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
it wasnt my code.
I agree its weird. I can snip it out though.
{ | ||
g_gamecallback->unpause(); | ||
//lua_pushboolean(L, true); | ||
return 1; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
incorrect return
@@ -358,6 +367,13 @@ void ScriptApiSecurity::initializeSecurityClient() | |||
copy_safe(L, os_whitelist, sizeof(os_whitelist)); | |||
lua_setfield(L, -3, "os"); | |||
lua_pop(L, 1); // Pop old OS | |||
|
|||
// Copy safe OS functions |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
these functions are absolutely not safe and allow unsandboxed access to the client filesystem
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Will remove this soon. Dont be fooled by this comment. It should say "Copy safe IO functions"
I'll compile and test later. Edit: Ok. So I compiled it and tested. First when going into settings if you click Hide: temporary settings. It crashes. |
@sfan5 I'm going to add a new function to just read the file of the settingtypes.txt without needing to expose |
There's no other way for me to rewrite this in Lua without enabling client modding, I think. The only other way would be to create an entirely new Lua context. Or to lie to the server...
Thanks. I think there are a few ways to crash the game. I'll have to mess more with it. |
@grorp Again... |
I'll steal an old comment to explain:
EDIT: Discovered that going strictly by the rules, there are still 3 months left, so removing the label again. |
@sfan5 Hey, i discussed it on mt dev irc, but should we add a new security layer for the main menu or the "game", i suppose? maybe even separate some bits of code? This will help me stub some work for the new main menu PRs, and will prevent me from writing crappy functions and exposing them on the server side to say, get the users settings and junk. it needs to be done at some point if we want to switch to offering game-specific customization of the main menus (discussed with greenxenith over discord unfortunately) without needing to hack over security. It would help this PR too. Was even thinking of providing an extra flag to CSM or something to make a client side mod "menu safe" |
Sure
CSM already has a security layer and I don't see how the mainmenu is relevant here. |
see this PR and how I've had to break security to get it to work soon people will download main menus from games which are pretty insecure atm i think |
and that is related how exactly? |
Oh you replied to another thing, my bad. I just wanted to know if we should make a new security layer that is more secure than the Client layer because we are going to let games customize the pause menu and main menu. Games you can download from the CDB |
Perspectively we should have main and pause menu customization but it's too early to say how the implementation will look. |
Right. Im getting ahead of myself.
The only way to do this correctly without breaking security on the client
side would be to just offer lua methods to return the games settings..
preferably as a table already, instead of doing it by hand like its being
done.
Im not a fan of how we change settings on the client game code, like fov
and such, but it is what it is.
…On Sun, Oct 6, 2024, 5:10 PM sfan5 ***@***.***> wrote:
Perspectively we should have main and pause menu customization but it's
too early to say how the implementation will look.
—
Reply to this email directly, view it on GitHub
<#14785 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AY22OG4MC6MLDVXCC6YBMNLZ2GRNBAVCNFSM6AAAAABJ62LMFCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDGOJVGU4DMNBWG4>
.
You are receiving this because you authored the thread.Message ID:
***@***.***>
|
#14781 was an utter failure, so I'm following up with a new PR that:
Also will add settings to the in-game menu (i haven't done it yet, but hold on a moment).
As my old PR said:
Not everything here is sunshines. The first case is removing
client->modsLoaded
from game.cpp. My change will likely force enable client modding, removing the need for a setting such asenable_client_modding
. Will there be any side effects of enabling client side modding by default?Hoping this really fixes #6722, #3165, and #6922.
There is also an opportunity to cleanup the pause menu, perhaps giving the controls text a much-needed facelift.
There was some mention on IRC of letting mods add new buttons, in a similar fashion to how
sfinv
works. I really like this idea and I'd be happy to implement it with no additional cost.How to test
enable_client_modding
totrue
(this wont be the case later?)