Darkplaces bug?

[Dooomer]

Hi there, I have been using Darkplaces in SP quake a lot, and is quite fond of it.

But unfortunately, with recent releases of Darkplaces, I have got some trouble.

The thing is, I would like to keep my Quake folder tidy and clean, so, I put all the SPmod in one sub-folder, something like this:

Quake
├─ID1
│
└─SPMod
--- ├─Bastion
--- ├─BBelief
--- ├─czg07
--- ├─Koohoo
--- ├─MALICE
--- └─ne_sp06

So, in order to run, say, czg07 (that is Insomnia, THE SPMod!), I need to use a command line like this:

"Quake-executive" -game SPMod\czg07

I can use this method to start whatever mod I want with every other engine, even with ID's winquake, and with every older darkplaces releases (older meaning released in 2006 and before). But with 2007 releases of Darkplaces, no luck at all! The executive just wouldn't start at all, unless I move the folder and use commandline like: Darkplaces -game czg07

So, what I want to ask is, is this a bug, or is this an intentional choice of the author?

Another bug I found is, with recent releases of Darkplaces, there seems to be some trouble running Nehahra (at least the menu is not correctly displayed).

[Baker]

This is probably going to require LordHavoc to answer.

I actually have a similar folder structure as yours with the gamedirs in a subdirectory, so I hope DarkPlaces is supposed to support this. (I usually use Enhanced GLQuake for mods because of the high mod compatibility, I tend to use DP for non-mod single player custom maps.)

/Yeah, Insomnia is one of the best. I probably enjoyed playing it more the first time through than any other single player mod.

[Dooomer]

Baker you are staying up so late? Take better care of yourself!

Yes I know this is a question to be answered by LordHavoc. But I prefered posting here to sending him an e-mail anyhow.

Personally I use Enhanced Glquake for nostalgia only.

Thanks for the bumping!

[Baker]

Baker you are staying up so late? Take better care of yourself!

OOOOF!

Yes I know this is a question to be answered by LordHavoc. But I prefered posting here to sending him an e-mail anyhow.

I think posting questions about a client in a forum is the more polite/efficient way to do it. He checks DarkPlaces-related threads here and you put it in the clients section so it's in the right place.

[Spirit]

Works in Linux.
Nice idea btw, I would have never thought about something like this.

[LordHavoc]

So, what I want to ask is, is this a bug, or is this an intentional choice of the author?

Intentional choice, and I've never heard of such a layout before.

I can modify the safety checks to permit subdirectories, but the Browse Mods menu won't detect things in SPMods/ so I'm not sure you should be using a layout like that even if I make it work from the commandline and console.

Another bug I found is, with recent releases of Darkplaces, there seems to be some trouble running Nehahra (at least the menu is not correctly displayed).

I don't know of any bugs with Nehahra at the moment, are you sure you used -nehahra on the commandline (not -game nehahra), as the readme states? There are many engine hacks needed for Nehahra compatibility, and it does not automatically assume that they should be active if running gamedir nehahra (I am considering that, however).

[Dooomer]

Hey, the author has come! Hooray!

Well, I would surely hope that you would be so kind as to re-enable this function of the quake engine, as it provides me with so much more convenience than a simple Mods menu (please don't take me wrong, Mods menu is a great feature, especially for new players of quake, but I just have become used to my own way of launching mods, and surely there is some beauty of simplicity to be found in this way too). Besides, this seems to be a "standard" quake engine feature, as every other engines seems to support it as far as I know. Is it possible to use a var command to switch this function on and off, instead of completely turning it off?


With the Nehahra issue, I am not sure if I used "-game Nehahra" or simply "-Nehahra". Need to check tomorrow. By the way, the Nehahra game files I used in this case is the pk3 archive downloaded from your site's file section.

All in all, Darkplaces is the most gorgeous engine for quake, so thank you LordHavoc and keep up with the good work!

[LordHavoc]

Hey, the author has come! Hooray!

Despite what Baker said, I actually reply to threads when someone points them out to me on IRC or by email (or when someone replies to a thread I posted on, which causes an email notification), I don't monitor the new threads (if there was a way to get email notifications about darkplaces threads I'd happily do so).

Well, I would surely hope that you would be so kind as to re-enable this function of the quake engine, as it provides me with so much more convenience than a simple Mods menu (please don't take me wrong, Mods menu is a great feature, especially for new players of quake, but I just have become used to my own way of launching mods, and surely there is some beauty of simplicity to be found in this way too).

As an aside, on Mac the Browse Mods menu is almost the only way to activate mods.

Besides, this seems to be a "standard" quake engine feature, as every other engines seems to support it as far as I know. Is it possible to use a var command to switch this function on and off, instead of completely turning it off?

Many "standard" quake engine features are inherently unsafe and dangerous

For example Quake mods can execute console commands, this has always been somewhat dangerous, but it got a lot more dangerous when DarkPlaces added the gamedir command and log_file cvar, as it means a mod could write files anywhere on the system maliciously if not for the fact DarkPlaces prevents all access to parent directory and other tricks, the gamedir restrictions are part of this protection, however weakening the protection enough to allow subdirectories should do no harm.

With the Nehahra issue, I am not sure if I used "-game Nehahra" or simply "-Nehahra". Need to check tomorrow. By the way, the Nehahra game files I used in this case is the pk3 archive downloaded from your site's file section.

Note that the -nehahra option (like all quake commandline options) is case sensitive, -Nehahra won't work.

Yeah it took a while to gather up all the Nehahra pieces to put together that pk3 archive, I thought it was really unfortunate that people kept having to piece it together themselves

All in all, Darkplaces is the most gorgeous engine for quake, so thank you LordHavoc and keep up with the good work!

Thanks.

[LordHavoc]

After investigating the FS_CheckNastyPath call on -game options, I can not see any reason it would reject -game SPMods/something, however it would reject -game SPMods\something, -game SPMods/something/, -game ./SPMods/something and several other things.

Are you sure you are using -game SPMods/nehahra -nehahra ?

P.S. Nehahra has deathmatch too you know
P.P.S. while on the subject of deathmatch in 'spmods' - Zerstorer deathmatch is fun and well designed.

[Dooomer]

Well, seems I didn't write it clearly enough in the first post.

The sub-folder launching bug is not about Nehahra, it's about other mods.

I don't place Nehahra in a sub-folder, as I occasionaly use nehahra.exe to play it.

Just tried darkplaces20070808, and it worked fine with nehahra !

Just used the command line like this to start Insomnia:
darkplaces.exe -game spmod/czg07

It's working all right:d !

In my opinion, darkplaces can use more documentation.

Anyway, my problems are solved. Thank you !

One more question, can it be made to work with parent folders? like:
__________
cd..
cd..
Darkplaces\darkplaces.exe -game ../spmod/czg07
________________________________

[Baker]

One more question, can it be made to work with parent folders? like:
__________
cd..
cd..
Darkplaces\darkplaces.exe -game ../spmod/czg07

*cough*That would be a major security violation and would enable the creation of virus-like mods, malware-like demos and hostile server commands.*/cough*

(/In fact, one engine [ezQuake] permits the writing of files outside the game folder and someday it would not be surprising if a malware demo or malicious server operator created something that overwrote critical operating system files.)

[LordHavoc]

One more question, can it be made to work with parent folders?

Certainly not, that is exactly the kind of security issue I mentioned.

[Dooomer]

(/In fact, one engine [ezQuake] permits the writing of files outside the game folder and someday it would not be surprising if a malware demo or malicious server operator created something that overwrote critical operating system files.)

As far as I know, currently darkplaces is the only engine that fixes this exploit.

All the other engines seem to care very little about this, for example, Enhanced Glquake and Fitzquake, as shown below. I didn't bother to test many of the other engines, but I highly suspect that they can work as well.

If this is really something important, maybe it's a good idea to get the attention of the authors of those engines, and have those engines fixed too.

[LordHavoc]

If this is really something important, maybe it's a good idea to get the attention of the authors of those engines, and have those engines fixed too.

The important part to prevent is ../ stuff in the console, the commandline launching the game (the -game options and such) is less important to secure (as there are myriad other programs capable of overwriting things by commandline, like the del command).

Since gamedir is supported by DarkPlaces, gamedir must be secured, similarly log_file, condump, and any other commands capable of writing files, as a malicious server admin could stuffcmd these to the client and cause it to overwrite important system files (at least when running administrator mode, which Windows XP users often do).

[Dooomer]

Hello, LordHavoc, I tested again and found that "-game spmod/something" can work, but "-game spmod/something/something_again" can not . Any safety reason?