sv_allowupload/download safe again?

[Bryantdl7]

Since the epic vin'll fix it hack I have sv_allowupload 0 and sv_allowdownload 0. the one problem im noticing is sprays dont like to show with those settings set up. Are they still major security risks?

[MrPresident]

This was patched pretty quickly. You should be safe to enable them again.

[JamminR]

I'm of the opinion though that, since I've seen at least 5 exploits due to those functions in the past 10 years, if sprays is all you want them for, it's not worth the risk of some yet unknown to use malicious use of them.
But, I'm a paranoid IT geek.

[MrPresident]

This is exactly why those vars are still disabled in my server. They were disabled before the exploit as well, which is why we were also unaffected.

[Avoid]

Hello,
I think this exploit should get fixed with the next update, until then use this library found: here

Code: [Select]

Sprays Fix
Description: I've released it before but I'll do it again, this prevents the sweg hackers from exploiting sv_allowupload/sv_allowdownload. Pretty much you can safely enable sprays with this.
Hope this helps,
Avoid

[Neku]

Hello,
I think this exploit should get fixed with the next update, until then use this library found: here

Code: [Select]

Sprays Fix
Description: I've released it before but I'll do it again, this prevents the sweg hackers from exploiting sv_allowupload/sv_allowdownload. Pretty much you can safely enable sprays with this.
Hope this helps,
Avoid

Huh, didn't know that existed.

Nice signature btw.

[Bryantdl7]

Hello,
I think this exploit should get fixed with the next update, until then use this library found: here

Code: [Select]

Sprays Fix
Description: I've released it before but I'll do it again, this prevents the sweg hackers from exploiting sv_allowupload/sv_allowdownload. Pretty much you can safely enable sprays with this.
Hope this helps,
Avoid

I'm gonna try this now and edit with my results.

[Sgt.Blue]

Was there ever any benefit to having the Cvars enabled in the first place?

[JamminR]

Yes, if someone doesn't have Fast Download separate server/url, it is an easy, if not extremely slower than fast dl, way to allow connecting people to get maps/models/etc.

[PAL-18]

If you want your spray to still appear but you also want to stay secure, here's a way i discovered:

• Set sv_allowupload and sv_allowdownload to 1 and restart the server.
• Set up your game to use your custom spray.
• Connect to your server and it will download the spray.
• Set sv_allowupload and sv_allowdownload to 0 and restart the server.
• Profit from you being the only player with a custom spray.

Note: If you change your spray, you'll need to do the above again.

[MrPresident]

Yes, if someone doesn't have Fast Download separate server/url, it is an easy, if not extremely slower than fast dl, way to allow connecting people to get maps/models/etc.

Just to break it down a little bit more:

sv_allowdownload allows players to download assets from a server (assuming they've added them to the list of things to be downloaded) if the server is NOT using FastDL.
sv_allowupload allows players to upload custom sprays.

If a server is using FastDL (sv_downloadurl) then sv_allowdownload is ignored and does nothing.

There have been exploits in the past with sv_allowupload and it's safe to just have it turned off if you don't care about sprays in your server.

[Bryantdl7]

Hello,
I think this exploit should get fixed with the next update, until then use this library found: here

Code: [Select]

Sprays Fix
Description: I've released it before but I'll do it again, this prevents the sweg hackers from exploiting sv_allowupload/sv_allowdownload. Pretty much you can safely enable sprays with this.
Hope this helps,
Avoid

thanks for showing me this avoid, but because I lack the time/smartness to figure it out I can't figure out why sprays won't show at all, with re-enabling sv_allowupload and sv_allowdownload sprays still do not work, don't ask me why as I said I don't have the time or the smartness to figure it out.

As far as the library itself goes, I cannot say if it works since sprays just won't work in general for me!

I think I will just lay sprays to rest and prevent the risk of getting hacked for a 7th time, lol.