Fix/316 sync

action/lrcon.cfg.example

@@ -0,0 +1,70 @@
+// LRCON Configuration Example
+// Copy to lrcon.cfg and customize for your server
+//
+// LRCON provides limited remote console access allowing players to
+// claim temporary admin rights and execute restricted server commands
+
+[settings]
+// Enable or disable LRCON on this server
+enabled 1
+
+// Quit the server when the last player leaves
+// Set to 1 to enable, 0 to disable (default)
+quit_on_empty 0
+
+[allowed_cvars]
+// List of cvars that can be queried and modified via lrcon
+// One cvar per line - only whitelisted cvars can be changed
+//
+// WARNING: Do NOT whitelist sensitive cvars here. In particular, NEVER add:
+//   rcon_password         - full server takeover
+//   password              - lock all other players out
+//   sv_load_ent           - bypass entity sandboxing
+//   sys_forcegamelib      - load arbitrary game DLLs
+//   sys_*                 - system-level cvars
+// Whitelist only gameplay-tuning cvars.
+//
+// Examples:
+timelimit
+fraglimit
+teamdm
+ctf
+maxclients
+hostname
+dmflags
+roundlimit
+matchmode
+teamplay
+g_select_empty
+sv_gravity
+sv_fps
+sv_antilag
+
+[allowed_stuffcmds]
+// Comma-delimited list of commands that may be sent to clients via
+// `lrcon stuffcmd <id|all> <command>`.
+//
+// SECURITY: If this section is empty or missing, all stuffcmds are DENIED.
+// Without an allowlist, a claimer can stuffcmd `disconnect`, `quit`,
+// arbitrary `bind`s, or chain commands — effectively RCE on every client.
+//
+// Recommended baseline allowlist (uncomment to enable):
+// disconnect, reconnect, say, say_team, record, stoprecord
+
+[modes]
+// Server configuration modes - allows players to switch configs quickly
+// Format: mode_name|exec <filename>.cfg
+//
+// SECURITY: mode commands MUST be of the form `exec <filename>.cfg`.
+// Filenames may only contain alphanumeric characters, '_', '-', '/', '.'.
+// No '..' path traversal, no absolute paths, no command chaining.
+// Malformed entries are rejected at startup with a warning.
+//
+// Examples:
+//
+// teamdm|exec cfg/teamdm.cfg
+// ctf|exec cfg/ctf.cfg
+// ffa|exec cfg/ffa.cfg
+// duel|exec cfg/1v1.cfg
+// instagib|exec cfg/instagib.cfg
+// campmode|exec cfg/campmode.cfg

doc/action.md

@@ -268,6 +268,15 @@ The forfeit system provides two ways to end a match early: captain-initiated for
 
 **Abandonment Forfeit**: When enabled, if all teams have zero players during a match in progress (at least one round played or any team has a score), the abandon timer begins counting down. If a player reconnects and joins a team before the timer expires, it resets. Warnings are printed at 30 seconds, 10 seconds, and a final 5-second countdown. If the timer expires, the match ends with no score awarded.
 
+#### Score Carryover
+
+In multi-map matches (e.g., best-of-two), team scores are normally reset when the map changes. Enabling `mm_carryover` preserves team scores from the first map into the second map, so the final scoreboard reflects the cumulative result across both maps.
+
+- Server settings:
+  - `mm_carryover [0/1]` - Carry over team scores from map 1 to map 2 (default: 0). Requires matchmode to be enabled. Supports `use_3teams`.
+
+After the second map concludes, the carryover is automatically cleared. Stat logging subtracts the carried-over scores so that per-map statistics remain accurate.
+
 #### Timeout Settings
 
 Timeouts allow teams to pause the match for a strategic break. The following cvars control timeout behavior:

src/action/a_cmds.c

@@ -1232,6 +1232,7 @@ void RemoveSpaces(char *s)
 void Cmd_AutoRecord_f(edict_t * ent)
 {
 	char rec_date[20], recstr[MAX_QPATH];
+	char *p;
 	time_t clock;
 
 	time( &clock );
@@ -1249,6 +1250,16 @@ void Cmd_AutoRecord_f(edict_t * ent)
 		Q_snprintf(recstr, sizeof(recstr), "%s-%s", rec_date, level.mapname);
 	}
 
+	/* Belt-and-suspenders: even though teamname intake sanitizes, scrub anything
+	 * that could break out of the quoted stuffcmd arg (recstr also includes
+	 * level.mapname which is engine-controlled but cheap to harden). */
+	for (p = recstr; *p; p++) {
+		if (*p == '"' || *p == '\\' || *p == '\n' || *p == '\r' ||
+		    *p == ';' || *p == '$' || (unsigned char)*p < 0x20) {
+			*p = '_';
+		}
+	}
+
 	stuffcmd(ent, va("record \"%s\"\n", recstr));
 }
 

src/action/a_esp.h

@@ -1,10 +1,6 @@
 // This is set to 1 if either atl or etv are 1
 extern cvar_t *esp;
 
-// Discrete game modes
-extern cvar_t *atl;
-extern cvar_t *etv;
-
 #define IS_LEADER(ent) (teams[(ent)->client->resp.team].leader == (ent))
 #define	HAVE_LEADER(teamNum) (teams[(teamNum)].leader)
 #define MAX_ESP_STRLEN 32

src/action/a_game.c

@@ -1659,13 +1659,23 @@ void ReadLrconConfig(void)
 	game.lrcon_config.quit_on_empty = 0;
 	game.lrcon_config.allowed_cvars_count = 0;
 	game.lrcon_config.modes_count = 0;
+	game.lrcon_config.allowed_stuffcmds_count = 0;
 
-	// Get config filename from cvar
+	// Get config filename from cvar.
+	// Validate value: must be a plain filename within the action/ directory.
+	// Without this, lrcon_config "../../../etc/crontab" would open arbitrary
+	// filesystem paths. Also replaces unbounded sprintf with Q_snprintf.
 	lrcon_config_cvar = gi.cvar("lrcon_config", "lrcon.cfg", 0);
-	if (lrcon_config_cvar->string && *(lrcon_config_cvar->string))
-		sprintf(cfgpath, "%s/%s", GAMEVERSION, lrcon_config_cvar->string);
-	else
-		sprintf(cfgpath, "%s/%s", GAMEVERSION, "lrcon.cfg");
+	{
+		const char *name = (lrcon_config_cvar->string && *lrcon_config_cvar->string)
+			? lrcon_config_cvar->string : "lrcon.cfg";
+		if (strstr(name, "..") || strchr(name, '/') || strchr(name, '\\') ||
+		    strchr(name, ':')) {
+			gi.dprintf("LRCON: refusing lrcon_config '%s' — must be a plain filename within action/\n", name);
+			return;
+		}
+		Q_snprintf(cfgpath, sizeof(cfgpath), "%s/%s", GAMEVERSION, name);
+	}
 
 	// Try to open config file
 	config_file = fopen(cfgpath, "r");
@@ -1738,15 +1748,78 @@ void ReadLrconConfig(void)
 							   game.lrcon_config.allowed_cvars[game.lrcon_config.allowed_cvars_count]);
 					game.lrcon_config.allowed_cvars_count++;
 				}
+			} else if (!strcmp(reading_section, "allowed_stuffcmds")) {
+				// Comma-delimited list of commands allowed via `lrcon stuffcmd`.
+				// Why: without an allowlist, a claimer can stuffcmd `disconnect`,
+				// `quit`, arbitrary `bind`s, or chain commands via ';' — effectively
+				// RCE on every connected client.
+				char *tok, *saveptr_buf = buf;
+				while ((tok = strtok(saveptr_buf, ", \t")) != NULL) {
+					saveptr_buf = NULL;
+					if (game.lrcon_config.allowed_stuffcmds_count >= MAX_LRCON_STUFFCMDS)
+						break;
+					if (!*tok)
+						continue;
+					Q_strncpyz(game.lrcon_config.allowed_stuffcmds[game.lrcon_config.allowed_stuffcmds_count],
+							   tok, sizeof(game.lrcon_config.allowed_stuffcmds[0]));
+					gi.dprintf("LRCON: allowed stuffcmd %d = %s\n",
+							   game.lrcon_config.allowed_stuffcmds_count,
+							   game.lrcon_config.allowed_stuffcmds[game.lrcon_config.allowed_stuffcmds_count]);
+					game.lrcon_config.allowed_stuffcmds_count++;
+				}
 			} else if (!strcmp(reading_section, "modes")) {
-				// Format: name|command
+				// Format: name|exec <filename.cfg>
+				// Why: mode command is passed verbatim to AddCommandString.
+				// Without restriction, an operator (or compromised config) can
+				// embed arbitrary commands via ';'. Restrict to strict
+				// "exec <safe-filename>.cfg" form.
 				char *pipe = strchr(buf, '|');
 				if (pipe != NULL && game.lrcon_config.modes_count < MAX_LRCON_MODES) {
+					const char *cmd, *fname;
+					size_t flen;
+					qboolean valid = true;
+
 					*pipe = 0;
+					cmd = pipe + 1;
+
+					// Must begin with "exec "
+					if (Q_strncasecmp(cmd, "exec ", 5) != 0) {
+						gi.dprintf("LRCON: rejecting mode '%s' — command must start with 'exec '\n", buf);
+						valid = false;
+					}
+
+					if (valid) {
+						fname = cmd + 5;
+						while (*fname == ' ') fname++;
+						flen = strlen(fname);
+
+						// Filename rules: non-empty, ends in .cfg, no traversal,
+						// only Q_ispath() chars plus '/' and '.'
+						if (flen < 5 || strcmp(fname + flen - 4, ".cfg") != 0) {
+							gi.dprintf("LRCON: rejecting mode '%s' — filename must end in .cfg\n", buf);
+							valid = false;
+						} else if (strstr(fname, "..") || fname[0] == '/' || fname[0] == '\\') {
+							gi.dprintf("LRCON: rejecting mode '%s' — filename has traversal or absolute path\n", buf);
+							valid = false;
+						} else {
+							const char *p;
+							for (p = fname; *p; p++) {
+								if (!(Q_ispath(*p) || *p == '/' || *p == '.')) {
+									gi.dprintf("LRCON: rejecting mode '%s' — filename has disallowed char\n", buf);
+									valid = false;
+									break;
+								}
+							}
+						}
+					}
+
+					if (!valid)
+						continue;
+
 					Q_strncpyz(game.lrcon_config.modes[game.lrcon_config.modes_count].name,
 							   buf, sizeof(game.lrcon_config.modes[0].name));
 					Q_strncpyz(game.lrcon_config.modes[game.lrcon_config.modes_count].command,
-							   pipe + 1, sizeof(game.lrcon_config.modes[0].command));
+							   cmd, sizeof(game.lrcon_config.modes[0].command));
 					gi.dprintf("LRCON: mode %d = %s -> %s\n",
 							   game.lrcon_config.modes_count,
 							   game.lrcon_config.modes[game.lrcon_config.modes_count].name,

src/action/a_match.c

@@ -92,6 +92,17 @@ void SendScores(void)
 	// Stats: Reset roundNum
 	game.roundNum = 0;
 	// Stats end
+
+	// Clear carryover scores after map 2 is done.
+	// Keep carryover_active=true so ExitLevel() won't re-save scores.
+	// SpawnEntities() on map 3 will reset carryover_active when it finds no scores.
+	if (game.carryover_active)
+	{
+		int i;
+		for(i = TEAM1; i < TEAM_TOP; i++)
+			game.carryover_scores[i] = 0;
+		gi.dprintf("Matchmode carryover: cleared after map 2\n");
+	}
 }
 
 void Cmd_Sub_f(edict_t * ent)
@@ -410,6 +421,13 @@ qboolean CheckAbandon(void)
 	if (!matchmode->value || !use_forfeit->value)
 		return false;
 
+	/* Treat forfeit_abandon_time <= 0 as "abandonment detection disabled".
+	 * Without this guard, abandonFrames becomes 0 in the registration path,
+	 * the `!level.abandonFrames` branch fires every server tick, and the
+	 * announcement spams the log forever. */
+	if (forfeit_abandon_time->value <= 0)
+		return false;
+
 	if (!team_game_going)
 		return false;
 
@@ -484,6 +502,22 @@ qboolean CheckAbandon(void)
 	return false;
 }
 
+/*
+ * Replace shell/stuffcmd-dangerous characters with '_' in-place.
+ * Why: team names are echoed into stuffcmd'd console commands (autorecord,
+ * etc.). An unescaped '"', ';', '\n', or '$' lets a captain inject commands
+ * into every other player's console.
+ */
+static void sanitize_command_arg(char *s)
+{
+	for (; *s; s++) {
+		if (*s == '"' || *s == '\\' || *s == '\n' || *s == '\r' ||
+		    *s == ';' || *s == '$' || (unsigned char)*s < 0x20) {
+			*s = '_';
+		}
+	}
+}
+
 void Cmd_Teamname_f(edict_t * ent)
 {
 	int i, argc, teamNum;
@@ -544,6 +578,11 @@ void Cmd_Teamname_f(edict_t * ent)
 		temp[18] = 0;
 	}
 
+	if (!temp[0])
+		strcpy( temp, "noname" );
+
+	sanitize_command_arg(temp);
+
 	if (!temp[0])
 		strcpy( temp, "noname" );
 
@@ -645,7 +684,10 @@ void Cmd_Teamnone_f(edict_t *ent)
 		return;
 	}
 
-	if (gi.argc() < 1) {
+	/* gi.argc() always returns at least 1 (the command name itself), so the
+	 * previous `< 1` guard was dead code — missing-arg silently fell through
+	 * with playernum=0 from atoi(""). */
+	if (gi.argc() < 2) {
 		gi.cprintf(ent, PRINT_HIGH, "You need to provide a playernum for this command\nUse 'playerlist' to get a list of playernums\n");
 		return;
 	}
@@ -897,7 +939,10 @@ void Cmd_CallTimeout_f(edict_t * ent)
 		return;
 	}
 
-	if (level.matchTime >= timelimit->value * 60) {
+	/* Skip the last-round guard when timelimit is unlimited (0). Otherwise
+	 * `matchTime >= 0` is always true and timeouts are blocked permanently
+	 * on unlimited-time servers. */
+	if (timelimit->value > 0 && level.matchTime >= timelimit->value * 60) {
 		gi.cprintf(ent, PRINT_HIGH, "You cannot call for a timeout on the last round of the match\n");
 		return;
 	}

src/action/g_local.h

@@ -793,6 +793,7 @@ typedef struct precache_s {
 
 #define MAX_LRCON_CVARS 32
 #define MAX_LRCON_MODES 16
+#define MAX_LRCON_STUFFCMDS 16
 
 /* LRCON state - tracks current server claim */
 typedef struct {
@@ -817,6 +818,8 @@ typedef struct {
   char allowed_cvars[MAX_LRCON_CVARS][64];  /* Whitelisted cvar names */
   int modes_count;            /* Number of available modes */
   lrcon_mode_t modes[MAX_LRCON_MODES];      /* Available server modes */
+  int allowed_stuffcmds_count;  /* Number of allowlisted client stuffcmds */
+  char allowed_stuffcmds[MAX_LRCON_STUFFCMDS][32];  /* Allowlisted commands for `lrcon stuffcmd` */
 } lrcon_config_t;
 
 //
@@ -879,6 +882,10 @@ typedef struct
 
   // LRCON configuration
   lrcon_config_t lrcon_config;
+
+  // Matchmode carryover scores (persist across map changes)
+  int carryover_scores[TEAM_TOP];
+  qboolean carryover_active; // true if we're on map 2 with carried-over scores
 }
 game_locals_t;
 
@@ -972,6 +979,7 @@ typedef struct
   int timeoutFrames;
   float matchTime;
   float emptyTime;
+  float quit_empty_time;  // LRCON quit_on_empty: level.time when server first emptied, or -1 if not empty. Separate from emptyTime which empty_rotate uses as an accumulator.
   int abandonFrames;  // Countdown for abandon forfeit
   int weapon_sound_framenum;
   int pic_teamplay_timer_icon;
@@ -1392,8 +1400,6 @@ extern cvar_t *medkit_value;
 
 // BEGIN AQ2 ETE
 extern cvar_t *esp;  // Enable or disable Espionage mode
-extern cvar_t *atl;  // Enable or disable Assassinate the Leader mode (do not set this manually)
-extern cvar_t *etv;	 // Enable or disable Escort the VIP mode (do not set this manually)
 extern cvar_t *esp_atl;  // Prefer ATL mode even if ETV mode is available
 extern cvar_t *esp_punish;  // Enable or disable punishment for losing the around
 extern cvar_t *esp_etv_halftime;  // Enable or disable halftime in ETV mode
@@ -1451,6 +1457,7 @@ extern cvar_t *bots; // If bots are enabled and in the server
 
 // 2026
 extern cvar_t *use_buggy_ent_hitbox;
+extern cvar_t *mm_carryover; // Carry over team scores across maps in matchmode
 
 #ifdef AQTION_EXTENSION
 extern int (*engine_Client_GetVersion)(edict_t *ent);