Zugg Software :: View topic

Posted: Tue Jan 02, 2007 6:13 am

the fact that cmud automatically (and without option if i've read correctly) expands variables in the command line is nice, however, its lack of security leaves alot to be desired.

While explaining on a public channel the effects of things such as "%pass" i conveniently alerted the mud to a password i use in quite a few places, which protects quite a bit of sensitive data.

Ok, so its nice to have this, but i think, looking back on it, that i woulda prefered to have to go [%pass] to make such a mistake, and be able to talk about %pass without wondering wtf i'm going to say by typing

Autolog is now disabled, and i'm writing something that will do the same thing, but without the possibility of spurting sensitive info to the world.

Big dissapointment there :(

Posted: Tue Jan 02, 2007 7:05 pm

That's a good point, I'm sure Zugg can probably set an override for that particular function (and it's corresponding command). Although I can't say I've ever come across that particular problem. But then again I would have probably disabled line parsing using the (`) character or just sent them directly to help files.

Hope you don't lose any info and I suggest you change your password quickly.

Posted: Tue Jan 02, 2007 9:13 pm

heh, That was half the drama, having to change a password that i used fairly widely (fairly? ok, so i used it everywhere that it would let me)

I think they're all changed now, but honestly, [expression] was a much nicer way to have stuff evaluate, and I wont be using cmud online until i hear of at least %pass being disabled *shrug*

Posted: Wed Jan 17, 2007 10:36 pm

I'll see if I can disable %pass on the command line in a future version.

And actually, zMUD had this same feature (called Expand Vars)...it just happened to be off by default.

Also, keep in mind that if you want to ensure that your text is sent to the MUD verbatim, you can enclose your MUD command in " quotes, or start the command line with the new ` line escape character, or toggle Parsing Off using the Ctrl-R key (or clicking on the parse option).

[expression] was only a nice way to evaluate stuff if your MUD didn't use [] for other stuff already, and lots of people complained about that wierd syntax for evaluating.

Posted: Wed Jan 17, 2007 10:53 pm

Can we have it back as a toggle then? Cos i know myself, and a bunch of zMudders on the mud i come from, automatically ~[do this~] to ~;special characters or press ctrl+r if we dont need any parsing at all, but the %pass thing was really quite distressing. I know expand vars was an option in zMud, but if i've read the forums correctly, that option no-longer exists in cMud.

Posted: Wed Jan 17, 2007 11:17 pm

I already said that I will be disabling %pass in a future version. No, I have no plans to add "Expand Vars" as a toggle back into CMUD. I know that it's hard adopting to new programs, but you just need to get used to the new program and that fact that [expression] has been replaced with (expression) and that variables are expanded. You can always put a ~ before the % like ~%pass. You just need to train your fingers to type the new stuff and not the old stuff.

Posted: Wed Jan 17, 2007 11:19 pm

hehe, well as long as %pass is going, i'll be happy :)