MrFrost Server Essentials

MrFrost Server Essentials Changelog, versions 1.0.4 to 1.1.0 github.com/MrFrostDev/MrFrost-ServerEssentials VERSION 1.1.0 (2026-08-01) BEFORE YOU UPDATE ! cooldownSeconds is held between 0 and 3600. Above 2,147,483 it used to wrap to a negative number and remove the cooldown entirely - the setting that asks for the strictest throttle gave the weakest. If your report.json sets it above 3600, it is now 3600. The server says so on its console when it caps. ! A server that shipped an infomenu.json without categories gave its players a Discord button pointing at the addon author's server, and no value it could write would stop it - an absent key and "" arrive identical, so the empty string the documentation offers as "draws no button" was the same input as saying nothing. The footer links are no longer inherited: a server that ships a file owns its own footer. If you rely on that inheritance, write discordUrl, websiteUrl and customUrl into your file. ! A strings override with no text blanked the widget it named instead of being ignored. If you used {"key": "...", "text": ""} deliberately to hide a label, that entry is now refused and the built-in wording comes back. FIXED - The report menu could not be used with a controller. Nothing held focus when it opened, so no button responded until a mouse moved the cursor onto one, and the info menu's page text could not be scrolled at all. Both menus now take focus on open and answer the stick. - One capital letter in a server file could replace the whole menu with the addon's demo content, silently. "enabled": True, a misspelt fasle, a number written .5, and a Windows path in a text value all passed the file check and then failed the parse - which cannot report failure, so every setting fell back to its default while the server console said the file had loaded. Those files are now rejected, by name, on the server console. - A file saved from Notepad or Out-File was rejected outright: both write a byte order mark, and the message sent the owner looking for a missing comma in a file whose punctuation was perfect. The mark is dropped. - A description at the documented maximum of 8191 could be cut through the middle of a character, which Discord rejects, losing that report. - A repeated content packet after a channel had finished put that channel back in the pending set, where nothing would ever complete it. The welcome menu then never opened again for the rest of the session. - The keys that open the two menus fired everywhere, including into an open menu and into the description box. Rebind Report to a letter and the first time you typed it the form closed and took the report with it; F11 over an open report menu buried it under the info menu. The keys now stay out of a menu they did not open, and switch between the two rather than stacking them. - The welcome menu could open a second time, over gameplay, up to two and a half minutes after a player had already read it and closed it themselves. - A menu whose content failed to load had no way out - the back prompt is built with the footer, and the footer came second. - logFile set to a reserved Windows device name (NUL, CON, COM1, ...) was accepted, and every report written to it was discarded while the console reported each one as written. - Warnings about settings that cannot change while the server runs were printed once per report rather than once. - The same merge discarded a discordLabel, websiteLabel, customLabel or menuIconImageset written without its paired key. - The menu opened from the pause screen before the server's content had arrived showed the addon's placeholder pages - and counted as the welcome, so the server's real one never opened. It no longer counts until the content is in, and a mission restart offers it again. - The title and the pause-menu entry read "Server Info" in English in all thirteen languages on a default install, because the shipped value won against the translated fallback. Both ship empty now and read "Info" in the player's own language; a server that sets either still gets exactly what it wrote. - The Discord sender stalled under a steady stream of reports: every new report pushed the next send further out, so one report went and the rest queued. SECURITY - With verboseLogging on, a modified client could write to the server log without bound: two paths logged a rejection per packet with no limit and, in one case, whatever text the client chose to put in it. - Control characters a player typed reached reports.log unfiltered, so a reporter could erase the lines above their own in a terminal. Discord's copy has always stripped them, so the two records of one report disagreed. CHANGED - A mistyped accentColor is now reported on the server console rather than in every player's log, where the owner who wrote the file could not see it. VERSION 1.0.7 (2026-08-01) BEFORE YOU UPDATE ! report.nobody_nearby now means the report was filed and nobody was named. It used to mean the report was refused. If you replaced that string through a strings block, re-read it before upgrading - your wording will still win over the built-in one, and it now describes the opposite of what happened. FIXED - With revealNobodyNearby on, a nearby report with nobody in range was thrown away rather than filed. The player was told something true about their surroundings and nothing about their report, and left able to send it again and lose it again. The report goes either way now. - Fourteen fields and a method on the modded player controller carried no prefix. A second mod picking one of those names collides in the same chain, and for the method that is a compile error - which takes down every mod on the server. - nearbyRadius at zero or below now falls back to 300, the way maxDescription falls back to 1000. No shipped configuration could reach that state; the guard closes the path rather than a symptom. - Several translations said the wrong thing: German called a bug report an error message, Portuguese and Chinese used the verb for denouncing a person on the bug tab specifically, and Spanish said players at the radius rather than within it. Four more drifted from the word their own language uses everywhere else, and the German player-picker label was half again as long as any sibling in a slot that cannot grow. - The website button was labelled in English for every player. The example infomenu.json no longer fills that label in, so copying it as documented leaves the translation in place. VERSION 1.0.6 (2026-08-01) FIXED - A server whose report.json could not be repacked without its webhook block said so once, in the middle of the first player's join, and every client after that quietly used the bundled settings. The client-safe form is now built when the server starts, where an owner is watching. - "categories": null, "strings": null or "entries": null in infomenu.json passed every check and then broke - on the server it cost the rest of the startup read, on clients it cost the content of a channel already marked as delivered. - A server file too large to send was transmitted in full to every joining player and discarded in total on arrival, with nothing said on either machine. The limit is now checked before sending, and named. - A report against a player picked from the list could name whoever inherited that player's id if they left while the report was being written. The pick now carries the name the reporter was looking at, and the server refuses it when the two no longer agree. - Content arriving over the network was installed without being checked, so a payload a client could not read came back as the addon's defaults while the console said the server's settings were in use. Both features check it now, the same way the server checks its own files. - A report that reached neither the log file nor Discord was reported to the owner as "neither is configured", contradicting the line above it that had just named the real reason - a full disk, or a queue that was full. VERSION 1.0.5 (2026-07-31) FIXED - Each footer link listened for its key twice, so one press opened the browser twice - and the second listener ran outside every guard the prompt applies, so with the report menu open on top of the info menu, typing a d into a description opened Discord. - Nothing bounded how many rows a server could have a client build. Each row is fifteen widgets, created up front, in a menu that opens by itself on join. A page of text far past any rule set is now left out rather than cut, because a cut cannot leave markup whole. - The accent colour never reached the line under the header, which kept the built-in gold whatever a server set. - A menu whose categories were all switched off still had a pause entry and a key, and opened empty - unless it carries footer links, which live nowhere else and would otherwise become unreachable. - A page with nothing on it said "this info menu has no entries yet", beside a full tree of categories. It has its own wording now. - Hosting your own game after playing on a server kept that server's menu, wording and log setting. - Whether to show the welcome menu was decided before the server's own content arrived, so a server that had switched it off could still be overridden. - A second connection in the same session was not recognised as a fresh start, and the player was never welcomed. - String overrides written into infomenu.json were honoured by every player and ignored in the server's own Discord embed. - "No other players" was written into the dropdown but never selected, so the closed box showed nothing at all. - The welcome menu gave up after about a minute of waiting, which the server's own content can outlast when several players join at once. It waits about two and a half minutes now. - The row icon column was two pixels narrower than the icon it holds. - The player dropdown was filled without being emptied first, so anything the layout shipped with would have shifted every index behind it. - The transfer confirmation could never appear in a client log, because verbose logging is a setting that arrives with the transfer it was meant to confirm. The server now says when it has sent everything, which is the only side that knows. - maxDescription of zero disabled the length cut on the addon config path, which the JSON path already guarded against. VERSION 1.0.4 (2026-07-31) ADDED - report.failed, told to a player whose report reached neither the log file nor Discord. Until now that was reported as sent. CHANGED - A footer link is only offered if it is an https:// address. The URL comes from the server and is never shown, so a button labelled Discord could lead anywhere. A link that does not qualify draws no button, and the server names the key on its own console when it reads the file. - A webhookUrl that is not an https:// address is dropped when the file is read rather than when the first report is already on its way. - The Discord queue is bounded. Past the cap the newest report is dropped, not the oldest, because the first reports of an incident are the ones a moderator wants. FIXED - Damage was watched on everything the world spawned, not only on players. That allocated per-entity data vanilla deliberately avoids, and with it present every bullet, fragment and damage tick on the server ran a script dispatch that could only ever be discarded. On a Conflict server with a few hundred AI alive, hundreds of them a second. - The report kind was taken from the client and only two values were tested for. A third slipped past both permission checks and arrived as a bug report on a server that had switched bug reports off. - Only accepted reports were rate limited. Every rejected one - no description, no target, nobody nearby, feature switched off - was free, so a modified client could hold the server in a loop of player sweeps at packet rate. - A client could ask for the server's files repeatedly. The guard only stopped overlapping transfers, so waiting for one to finish and asking again rebuilt everything, without limit. - A report could be lost while the player was told it had been sent. - Server files were sent with their indentation, which on a pretty-printed config is easily a tenth of every byte sent to every player who joins. - The packet count for a transfer depended on how the server owner had formatted their JSON, not on how large it was. - The client-safe form of each file was rebuilt for every joining player, though it is the same for all of them. - Transfer pacing was per player, so sixty-four clients joining after a restart ran sixty-four independent senders at once - the burst the pacing exists to prevent. - A control character in a description made Discord reject the whole message, with an error naming the webhook settings rather than the cause. - Embed titles, footers and the webhook username went to Discord unbounded. - maxDescription set to zero disabled the length cut entirely instead of meaning what it says. - Reports left the Discord queue out of order when several arrived close together. - A second answer could overwrite the first, telling a player their filed report had bounced. - The info menu built every row with two colour animations that ramped from transparent to transparent, each costing a scan of a global animation list. SECURITY - A malicious client could make the server allocate an array sized by a number it chose, and a malicious server could do the same to every client that joined it. Both are bounded now.