- Panel over HTTPS on the game port (TLS handshake detected like HTTP); self-signed
certificate in data/panel_cert.pfx (fingerprint in the log) or an own PFX
(PanelCertificatePath); remote HTTP is redirected to HTTPS (not locally / behind
a proxy); cookie Secure over HTTPS; PanelHttps=false turns it off
- Panel login: also locked per user name (16 failures / 15 min), failure lists
bounded, user names in the log without control characters
- panel_users.json, panel_sessions.json, server.json, certificate: owner-only on Linux
- Players: names/chat without control or direction characters (no fake log lines),
no '<' '>' in names; '* ' system-style chat, msco.* messages (time/weather) and
MSCO_INSTALL only from admins; NaN/absurd money changes dropped (could break the
shared money for good)
- Extra headers: Permissions-Policy, Cross-Origin-Opener-Policy
- 11 new tests (165 pass)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
WorldVars and VehicleControls were only relayed; players joining later only
got them with the next save pull. They are now stored in world.json (cleared
with a new save) and appended to the world snapshot (old clients ignore it).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
MrMahoandClaude Opus 5.5