Skip to content

Add custom ConVar whitelist & cfg parser systems#456

Open
Vauff wants to merge 3 commits into
devfrom
cvar-whitelist
Open

Add custom ConVar whitelist & cfg parser systems#456
Vauff wants to merge 3 commits into
devfrom
cvar-whitelist

Conversation

@Vauff

@Vauff Vauff commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

Until now, we've been unable to use Valve's ConVar whitelist system both due to a lack of customization (the config is packed in game vpk's), and because of a bug where non-map server cfg's also got subjected to whitelist limitations. This PR solves both of these problems, and now allows for running servers properly without the -disable_workshop_command_filtering startup parameter for protection against malicious/overbearing workshop maps.

Custom ConVar Whitelist

For the most part, this behaves similarly to Valve's own whitelist system, especially since we hook into it for blocking/allowing commands. cs2f_cvarwhitelist_enable must be enabled & configs/cvar_whitelist.jsonc needs to have .example removed from the filename.

While Valve's original workshop_cvar_whitelist.txt has been copied into the config file, we've taken the liberty of customizing it for a better out of the box experience for dedicated server/Zombie Escape environments. However, you can still customize it for your own use cases.

One additional feature we've implemented is the ability to set up map specific overrides like so:

{
	"ze_my_first_ze_map":
	{
		"sv_airaccelerate": false,
		"sv_noclipspeed": true
	},
	"ze_last_man_standing_p":
	{
		"zr_infect_spawn_mz_ratio": true
	},

	"sv_airaccelerate": true,
	"zr_infect_spawn_mz_ratio": false
}

In this example config, most maps would only be able to execute sv_airaccelerate. While ze_my_first_ze_map can only execute sv_noclipspeed, and ze_last_man_standing_p can execute both sv_airaccelerate and zr_infect_spawn_mz_ratio.

Custom CFG Parser

Plugin cfg's have been switched to use this new parser, which is effectively just passing each line of the supplied .cfg into ServerCommand. This method bypasses the ConVar whitelist for server cfg's.

cfg/cs2fixes/server.cfg has also been introduced as a replacement for cfg/server.cfg, which became basically useless due to the server cfg whitelist bug. If you have additional cfg's beyond server.cfg, you can also execute these by adding lines such as exec_custom gamemode_casual_custom into the cfg.

exec_custom is not whitelisted and thus can't be included in cfg's executed by the game.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant