From: divverent <divverent@d7cf8633-e32d-0410-b094-e92efae38249>
Date: Thu, 9 Apr 2009 08:24:52 +0000 (+0000)
Subject: when changing rcon_secure, always clear rcon_password, to prevent a send-as-plaintext... 
X-Git-Tag: xonotic-v0.1.0preview~1721
X-Git-Url: https://git.rm.cloudns.org/?a=commitdiff_plain;h=f7333852c777ef2ab1e0a22c90f3009558a46ae2;p=xonotic%2Fdarkplaces.git

when changing rcon_secure, always clear rcon_password, to prevent a send-as-plaintext attack


git-svn-id: svn://svn.icculus.org/twilight/trunk/darkplaces@8889 d7cf8633-e32d-0410-b094-e92efae38249
---

diff --git a/cvar.c b/cvar.c
index 47a5735d..27ece13a 100644
--- a/cvar.c
+++ b/cvar.c
@@ -294,6 +294,13 @@ void Cvar_SetQuick_Internal (cvar_t *var, const char *value)
 			CL_SetInfo("playermodel", var->string, true, false, false, false);
 		else if (!strcmp(var->name, "_cl_name"))
 			CL_SetInfo("name", var->string, true, false, false, false);
+		else if (!strcmp(var->name, "rcon_secure"))
+		{
+			// whenever rcon_secure is changed, clear rcon_password for
+			// security reasons (prevents a send-rcon-password-as-plaintext
+			// attack based on NQ protocol session takeover and svc_stufftext)
+			Cvar_Set("rcon_password", "");
+		}
 	}
 }
 
diff --git a/host_cmd.c b/host_cmd.c
index 6c051d9f..8b0b56a1 100644
--- a/host_cmd.c
+++ b/host_cmd.c
@@ -32,8 +32,8 @@ cvar_t sv_cheats = {0, "sv_cheats", "0", "enables cheat commands in any game, an
 cvar_t sv_adminnick = {CVAR_SAVE, "sv_adminnick", "", "nick name to use for admin messages instead of host name"};
 cvar_t sv_status_privacy = {CVAR_SAVE, "sv_status_privacy", "0", "do not show IP addresses in 'status' replies to clients"};
 cvar_t sv_status_show_qcstatus = {CVAR_SAVE, "sv_status_show_qcstatus", "0", "show the 'qcstatus' field in status replies, not the 'frags' field. Turn this on if your mod uses this field, and the 'frags' field on the other hand has no meaningful value."};
-cvar_t rcon_password = {CVAR_PRIVATE, "rcon_password", "", "password to authenticate rcon commands"};
-cvar_t rcon_secure = {0, "rcon_secure", "1", "force secure rcon authentication"};
+cvar_t rcon_password = {CVAR_PRIVATE, "rcon_password", "", "password to authenticate rcon commands; NOTE: changing rcon_secure clears rcon_password, so set rcon_secure always before rcon_password"};
+cvar_t rcon_secure = {CVAR_NQUSERINFOHACK, "rcon_secure", "1", "force secure rcon authentication; NOTE: changing rcon_secure clears rcon_password, so set rcon_secure always before rcon_password"};
 cvar_t rcon_address = {0, "rcon_address", "", "server address to send rcon commands to (when not connected to a server)"};
 cvar_t team = {CVAR_USERINFO | CVAR_SAVE, "team", "none", "QW team (4 character limit, example: blue)"};
 cvar_t skin = {CVAR_USERINFO | CVAR_SAVE, "skin", "", "QW player skin name (example: base)"};