ModernItemBlocker v4.2.0 — Security review hardening & DunganSoft Technologies metadata refresh

Verified compatible with Oxide 2.0.7022+ (Rust Naval Update) through 2.0.7214 (2026-05-17).
Drop-in upgrade from any 4.1.x release — no config or language-file migration required.

Highlights
This release is the output of a fresh security pass against the latest Facepunch Rust and Oxide framework releases. Four defence-in-depth fixes land in the hot path and audit-log writer, the author is updated to Gabriel Dungan (DunganSoft Technologies), and two long-missing repository documents — INSTALL.md and CONTRIBUTING.md — are added.

Security & correctness
Path-traversal prefix check tightened in HandleLogListCommand. The previous Path.GetFullPath(f).StartsWith(resolvedDir) guard accepted any sibling directory sharing a prefix string (e.g. /oxide/logs-evil/file.txt satisfied StartsWith("/oxide/logs")). The resolved directory is now suffixed with Path.DirectorySeparatorChar before the comparison so only true children of the log directory pass. Practical exploitation required a symlink inside the directory and was therefore defence-in-depth only, but the guard now fails closed if Directory.GetFiles semantics ever change.
LogBlockAttempt null-guards player.transform. In a disconnect race between a block hook firing and the audit log writing, transform can be torn down before LogBlockAttempt runs. Reading .position would throw NullReferenceException and abort the log entry entirely. Position is now read defensively; at unknown is recorded when the transform is gone.
InDuel exception logging is now warn-once per duelling plugin. 4.1.3 promoted silent catch { } to PrintWarning so a broken duel-plugin integration could not silently bypass blocking. On a busy server with a permanently incompatible duel plugin that produced hundreds of identical warnings per second. A latched bool per call site (_warnedDuelsManager, _warnedDuel) suppresses subsequent identical warnings; latches are cleared in Unload() so the operator still sees the warning resurface on the next reload.
Log directory resolved from Interface.Oxide.LogDirectory when available, falling back to the previous Path.Combine(RootDirectory, "oxide", "logs") for older Oxide builds. More robust against future Oxide directory-layout changes.
Compatibility
Verified against Oxide 2.0.7214 (2026-05-17). No hook-signature changes affecting CanEquipItem, CanWearItem, OnMagazineReload, or CanBuild were introduced between 2.0.7022 and 2.0.7214; the plug-in continues to work without modification on every release in that range.
No breaking changes for operators upgrading from any 4.1.x release. Existing oxide/data/ModernItemBlockerConfig.json and oxide/lang//ModernItemBlocker.json files remain valid.
Metadata
Author updated to Gabriel Dungan (DunganSoft Technologies) in the [Info] attribute, manifest.json, .umod.yaml, LICENSE, LICENSE.md, and the README credits line. GitHub handle gjdunga is preserved under a new author_github key.
Version bumped 4.1.4 → 4.2.0 in plug-in source header, [Info] attribute, manifest.json, .umod.yaml, README header, INSTALL.md, and the new changelog.md heading.
Documentation
INSTALL.md (new) — requirements matrix, fresh install, upgrade from 4.1.x, permissions setup, verification, uninstall, and a troubleshooting table.
CONTRIBUTING.md (new) — branch model, coding standards (target framework, hot-path rules, lang-key policy), pull-request checklist, and a security-disclosure policy.
README.md — version / author / license header block added at the top; the installation section now points to INSTALL.md for the full walkthrough; new "Contributing" section linking to CONTRIBUTING.md; credits line refreshed.
changelog.md — 4.2.0 entry grouped into Security Fixes, Performance / Operability, Compatibility, Metadata, and Documentation.
Upgrade instructions
Stop the server (or be ready to reload).
Replace oxide/plugins/ModernItemBlocker.cs with the new file.
oxide.reload ModernItemBlocker (or restart the server).
Confirm the version line in the console:
Loaded plugin Modern Item Blocker v4.2.0 by Gabriel Dungan (DunganSoft Technologies)
See INSTALL.md for the full walkthrough and changelog.md for the detailed change log.

Files
oxide/plugins/ModernItemBlocker.cs — v4.2.0 plug-in source.
oxide/data/ModernItemBlockerConfig.json — config sample (unchanged).
oxide/lang/{en,ru,es,la}/ModernItemBlocker.json — language files (unchanged).
INSTALL.md, CONTRIBUTING.md, README.md, LICENSE.md, LICENSE, manifest.json, .umod.yaml, changelog.md.
Credits
Written and maintained by Gabriel Dungan, DunganSoft Technologies (GitHub: @gjdunga).
Licensed under the MIT License.