kade-github / dra-archived Goto Github PK

Add steam id auth (verification of powers after steam id)

delete this

Please off announcement welcome and success.And Players refresh in list setting

Ban command doesn't work and maybe make buttons to ban to day, minute or hour?
Next, nuke doesn't start

In server console just appear message what nuke started, but it doesn't

And to DRA can only connect by local IP, not public, port are forwared!

This plugin has a lot of good idea but it falls flat on server side security.

1st default password NO NO NO
2nd Limit the number of requests sent by 1 IP
3rd "like i said, entirely ignore your UI/clientside stuff
we're talking vulnerabilities so make the assumption that someone has their owned malicious client sending requests to your API
for example
I could write some code that spams random passwords at your login endpoint until it returns true
then I know which password is correct
and I use it in every command request"
4th

JUST REMOVE THE PLUGIN!!!!!!!!!!!!