Restrict maximum length of messages to 50.000 characters and disable sending functions or table references over the wire. Restrict types of channel variable to string, number or boolean.
The missing length restriction made DoS-like attacks possible by overflowing memory using string concatenation. Thanks to gamemanj for disclosing this issue.
Duplicating that small piece of code seems like a better idea than
putting the undo-forceloading code back into util.lua. This way, it is
easier to remember to remove that unneccesary code after a couple of
months / years, when people have transitioned. This also means we can
make changes to the code in util.lua without breaking old code.
Instead of seperately looking for onstate receptors along equipotential
sections of the circuit before turning off, do that while already
modifying the VoxelManip. In case an onstate receptor is found, discard
the VoxelManip cache, otherwise commit it after turnoff is completed.
It is no longer possible for get_node_force to return nil if the target
location does, in fact, exist, because a VM will always be able to load
it (whereas a forceload might not, due to exhaustion of forceload
resources). So it is no longer necessary to handle get_node_force
returning nil by deferring processing.
VoxelManipulator-based transactions are used to hopefully speed up
scanning and replacing of networks of conductors when receptors start or
stop driving signals into them.
Rather than calling out through the Lua-to-C API for each node that
needs to be read or written, a group of map reads (and optionally
writes) can be grouped into a transaction. Access to map data within the
transaction is provided at high speed by means of VoxelManipulators.
Once the reads and writes are finished, the transaction can be committed
or aborted.
A VoxelManipulator, when asked to read a mapblock, in addition to making
that mapblock available to the caller, also pulls it into the server’s
map cache, thus making get_node calls in the immediate future succeed.
This has the dual advantages that not every mapblock containing a
Mesecons circuit need remain loaded at all times (rather mapblocks can
be loaded on demand as signals are sent), and that the server need not
bother running ABMs and ticking entities within those mapblocks that are
loaded due to Mesecons signalling.
The update_autoconnect function had to be abstracted away from the
default wires, any kind of wire can now register autoconnect hooks,
which should make having multiple different wire types much easier.
mesecons_mvps, mesecons_receiver and mesecons_random made use of
update_autoconnect, their code was also adapted. This also fixes a
receiver bug: If a receiver was placed with a onstate receptor next
to it (but not the wall lever / button that caused the receiver to
appear) the receiver didn't turn on in the past.
Also move documentation for mesecon wire into mesecons_wire.
Disabling LuaJIT for user code enables normal working of debug.sethook() even for loops. The drawback is that that code will run more slowly.
The fourth parameter of string.find indicates whether the second parameter should be interpreted literally (true) or as a pattern (false). Allowing patterns enables DoS attacks, but it's possible to
allow literal matching with little effort, by disallowing the function only if the fourth parameter (plain mode) is not `true`.
prohibited, remove pcall and xpcall, fix global lookup of "jit"
variable, correct error locations
Thanks to @ShadowNinja and @gamemanj for fixing this in #241
This is a major speedup for large mesecon machines / structures.
Force-loaded areas are stored in a file to be persistent over server
reboots. By default, areas are unloaded after 10 minutes (600s) without
usage, this can be customized with the mesecon.forceload_timeout
setting. Please turn max_forceloaded_blocks up for better performance.
I've implemented a new door API in minetest_game that
performs all the needed things to assure doors are
properly openend and closed, without mods needing to
know the inner details of what needs to be done.
Mesecons can just fetch a reference to the door object
and call the appropriate open or close method, which
simplifies this code a lot.
For compatibility, this code retains the old code path
and tests whether the new API is available, so this
code remains functional if the new API is not available.
Since the metal trapdoor was only recently added, I added
it to the new API codepath only, it's unlikely to be
present on older versions of minetest_game anyway.
As a benefit from the new door API, there is now
absolutely no more accidental switching closed trapdoors
to open on power off, which could happen with the
old method - since that was just a simple toggle.
