dont modify cilbox

more cleanup

needs cleanup still

more cleanup

Author: dooly123

Basis Server/BasisNetworkCore/BasisConfigXmlDocs.cs

@@ -205,6 +205,7 @@ private static void RegisterServerConfig()
             t.Fields.Add(new FieldDoc("VoiceChatLocked", " Drop voice (normal and shout) from peers lacking basis.voice.lockbypass. Enforced server-side, so a modified client cannot talk past it. true|false; default false. "));
             t.Fields.Add(new FieldDoc("MediaPlayerLocked", " Stop non-bypass clients from loading new media player URLs and from accepting inbound ones. Enforced client-side (media state rides the generic scene relay). Already-playing media keeps playing. true|false; default false. "));
             t.Fields.Add(new FieldDoc("CameraCaptureLocked", " Stop non-bypass clients from taking photos with the handheld camera. Enforced client-side (capture is entirely local). Separate from CameraMetadataDisallowMask, which only strips metadata. true|false; default false. "));
+            t.Fields.Add(new FieldDoc("SafeDisplayNamesForced", " Render other players' display names with rich-text markup stripped and TMP rich text off. Enforced client-side. Stops name markup being used to draw over the screen. true|false; default false. "));
             t.Fields.Add(new FieldDoc("PropGrabbingLocked", " Stop non-bypass clients from picking up or grabbing props. Enforced client-side (grabbing is local interaction logic). Separate from PropsLocked, which blocks prop loading instead. true|false; default false. "));
             _docs[typeof(global::Configuration)] = t;
         }

Basis Server/BasisNetworkCore/BasisServerConfiguration.cs

@@ -220,6 +220,11 @@ public class Configuration
     /// *loading* rather than handling already-spawned ones. Default off.
     /// </summary>
     public bool PropGrabbingLocked = false;
+    /// <summary>
+    /// When true, clients render other players' display names with rich-text markup stripped and
+    /// TMP rich text disabled on the nameplate. Enforced client-side. Default off.
+    /// </summary>
+    public bool SafeDisplayNamesForced = false;
 
     // ── REST API ──────────────────────────────────────────────────────────────
     /// <summary>Set to true to enable the REST management API.</summary>
@@ -321,6 +326,16 @@ public void ProcessEnvironmentalOverrides()
         ApplyEnvironmentalOverridesTo(this);
     }
 
+    /// <summary>Field names whose values must never reach the log.</summary>
+    private static bool IsSecretFieldName(string fieldName)
+    {
+        if (string.IsNullOrEmpty(fieldName)) return false;
+        return fieldName.IndexOf("password", StringComparison.OrdinalIgnoreCase) >= 0
+            || fieldName.IndexOf("apikey", StringComparison.OrdinalIgnoreCase) >= 0
+            || fieldName.IndexOf("secret", StringComparison.OrdinalIgnoreCase) >= 0
+            || fieldName.IndexOf("token", StringComparison.OrdinalIgnoreCase) >= 0;
+    }
+
     private static void ApplyEnvironmentalOverridesTo(object target)
     {
         if (target == null) return;
@@ -338,7 +353,7 @@ private static void ApplyEnvironmentalOverridesTo(object target)
             string value = Environment.GetEnvironmentVariable(field.Name);
             if (value == null) continue;
 
-            BNL.Log($"Applying Environmental Override with Field:{field.Name} Value:{value}");
+            BNL.Log($"Applying Environmental Override with Field:{field.Name} Value:{(IsSecretFieldName(field.Name) ? "<redacted>" : value)}");
 
             if (field.FieldType == typeof(int))
             {

Basis Server/BasisNetworkCore/NetDataReader.cs

@@ -224,6 +224,10 @@ public void Get(out Guid result)
 
         public byte GetByte()
         {
+            // _data is the pooled buffer and outlives this packet, so an unchecked read past
+            // _dataSize returns a stale byte instead of faulting.
+            if (_position >= _dataSize)
+                throw new InvalidOperationException($"Not enough data to read 1 byte. Position={_position}, DataSize={_dataSize}");
             byte res = _data[_position];
             _position++;
             return res;

Basis Server/BasisNetworkCore/Serializable/AdminRequest.cs

@@ -188,6 +188,11 @@ public enum AdminRequestMode : byte
             // props. Enforced client-side — grabbing is local interaction logic. Separate from
             // GlobalToggleProps, which blocks prop loading instead.
             GlobalTogglePropGrabbing,
+
+            // admin: toggle forced safe display names. While set, clients strip rich-text markup
+            // from other players' display names and disable TMP rich text on the nameplate.
+            // Enforced client-side — nameplate rendering is entirely local.
+            GlobalToggleSafeDisplayNames,
         }
     }
 }

Basis Server/BasisNetworkCore/Serializable/BasisMessageManifest.cs

@@ -85,6 +85,14 @@ public bool Deserialize(NetDataReader reader)
                 return false;
             }
 
+            // Each descriptor costs at least a byte on the wire.
+            if (count > reader.AvailableBytes)
+            {
+                BNL.LogError($"BasisMessageSupply: count {count} exceeds available {reader.AvailableBytes}");
+                Descriptors = Array.Empty<BasisMessageDescriptor>();
+                return false;
+            }
+
             Descriptors = new BasisMessageDescriptor[count];
             for (int i = 0; i < count; i++)
             {
@@ -126,6 +134,14 @@ public bool Deserialize(NetDataReader reader)
                 return false;
             }
 
+            // Each id is 2 bytes on the wire.
+            if (count * 2 > reader.AvailableBytes)
+            {
+                BNL.LogError($"BasisMessageSubscribe: count {count} exceeds available {reader.AvailableBytes}");
+                Ids = Array.Empty<ushort>();
+                return false;
+            }
+
             Ids = new ushort[count];
             for (int i = 0; i < count; i++)
             {

Basis Server/BasisNetworkServer/BasisNetworkMessageProcessor/BasisNetworkMessageProcessor.cs

@@ -15,6 +15,8 @@
 public static class BasisNetworkMessageProcessor
 {
     private const int MaxErrorsBeforeWarning = 50;
+    /// <summary>Protocol errors tolerated from one peer before it is dropped.</summary>
+    private const int MaxErrorsBeforeDisconnect = 500;
     private static readonly ConcurrentDictionary<int, int> _peerErrorCounts = new();
 
     public static void ClearPeerErrors(int peerId) => _peerErrorCounts.TryRemove(peerId, out _);
@@ -60,12 +62,7 @@ public static void ProcessMessage(NetPeer peer, NetPacketReader reader, byte cha
                 );
             }
             reader.Recycle();
-            if (errorCount >= MaxErrorsBeforeWarning)
-            {
-                BNL.LogError($"Peer {peer.Id} has reached {errorCount} protocol errors. The server has detected an issue with this client or its connection.");
-                BasisPlayerModeration.SendBackMessage(peer, "The server has detected an issue with your client or connection. You may experience problems.");
-                _peerErrorCounts.TryRemove(peer.Id, out _);
-            }
+            HandleErrorEscalation(peer, errorCount);
         }
     }
 
@@ -77,11 +74,25 @@ private static void HandleUnknown(NetPeer peer, NetPacketReader reader, byte cha
             BNL.LogError($"Unknown {kind}: {channel} ({reader.AvailableBytes} bytes remaining) from peer {peer.Id} (error #{errorCount})");
         }
         reader.Recycle();
-        if (errorCount >= MaxErrorsBeforeWarning)
+        HandleErrorEscalation(peer, errorCount);
+    }
+
+    /// <summary>
+    /// Warns once at the warning threshold and disconnects at the hard limit. The counter must
+    /// not be cleared on warning, or the limit can never be exceeded.
+    /// </summary>
+    private static void HandleErrorEscalation(NetPeer peer, int errorCount)
+    {
+        if (errorCount == MaxErrorsBeforeWarning)
         {
             BNL.LogError($"Peer {peer.Id} has reached {errorCount} protocol errors. The server has detected an issue with this client or its connection.");
             BasisPlayerModeration.SendBackMessage(peer, "The server has detected an issue with your client or connection. You may experience problems.");
+        }
+        else if (errorCount >= MaxErrorsBeforeDisconnect)
+        {
+            BNL.LogError($"Peer {peer.Id} exceeded {MaxErrorsBeforeDisconnect} protocol errors; disconnecting.");
             _peerErrorCounts.TryRemove(peer.Id, out _);
+            peer.Disconnect();
         }
     }
 }

Basis Server/BasisNetworkServer/BasisNetworkResourceManagement.cs

@@ -174,6 +174,18 @@ public static void UnloadResource(UnLoadResource unLoadResource, NetPeer peer)
             return;
         }
 
+        // Creator-or-moderator, same rule SetStatic applies. The unload permission node is in the
+        // default group, so without this any player can delete every other player's props.
+        bool isModeratorUnload = PermissionIntegration.HasValidRequirement(peer, PermNodes.protection);
+        bool isCreatorUnload = NetworkServer.AuthIdentity.NetIDToUUID(peer, out string unloadRequesterUuid)
+            && !string.IsNullOrEmpty(resource.UUIDOfCreator)
+            && unloadRequesterUuid == resource.UUIDOfCreator;
+        if (!isCreatorUnload && !isModeratorUnload)
+        {
+            BNL.LogError($"Peer {peer.Id} tried to unload [{unLoadResource.LoadedNetID}] they did not create.");
+            return;
+        }
+
         // Only remove AFTER validation
         if (!UshortNetworkDatabase.TryRemove(unLoadResource.LoadedNetID, out _))
         {

Basis Server/BasisNetworkServer/BasisNetworking/BasisNetworkContentShare.cs

@@ -140,6 +140,14 @@ public static void HandleContentShareCleanup(NetPacketReader reader, NetPeer pee
         {
             return;
         }
+        // ContentShareDelete is default-granted, so the sharer check is what stops one player
+        // deleting everyone else's orbs.
+        if (existing.playerIdMessage.playerID != (ushort)peer.Id
+            && !PermissionIntegration.HasValidRequirement(peer, PermNodes.protection))
+        {
+            BNL.LogError($"Peer {peer.Id} tried to remove content sphere {msg.SphereNetID} they did not share.");
+            return;
+        }
         if (ActiveSpheres.TryRemove(msg.SphereNetID, out _))
         {
             BNL.Log($"Content sphere removed: {msg.SphereNetID}");

Basis Server/BasisNetworkServer/BasisNetworking/BasisNetworkOwnership.cs

@@ -57,8 +57,12 @@ public static void RemoveOwnership(NetPacketReader Reader, NetPeer Peer)
             {
                 if (ownershipByObjectId.TryGetValue(ownershipTransferMessage.ownershipID, out ushort PlayerId))
                 {
-                    if (PlayerId == ownershipTransferMessage.playerIdMessage.playerID)
+                    // Authorize against the sending peer, not the id in the packet: the client
+                    // fills that field in itself, so trusting it lets any peer release any
+                    // object by naming its owner.
+                    if (PlayerId == (ushort)Peer.Id)
                     {
+                        ownershipTransferMessage.playerIdMessage.playerID = PlayerId;
                         if (RemoveObject(ownershipTransferMessage.ownershipID))
                         {
                             NetDataWriter Writer = NetworkServer.RentWriter();

Basis Server/BasisNetworkServer/BasisServerHandleEvents.cs

@@ -1421,7 +1421,16 @@ public static void UnloadResource(NetPacketReader Reader, NetPeer Peer)
             UnLoadResource.Deserialize(Reader);
             Reader.Recycle();
 
-            switch (UnLoadResource.Mode)
+            // Tier comes from the stored record, not the packet: Mode is client-supplied and is
+            // never compared against the target, so a user denied world-unload could send Mode 0
+            // and have the prop permission checked instead.
+            if (!BasisNetworkResourceManagement.UshortNetworkDatabase.TryGetValue(UnLoadResource.LoadedNetID, out LocalLoadResource TargetResource))
+            {
+                BNL.LogError($"Trying to unload an object that does not exist! ID Provided was [{UnLoadResource.LoadedNetID}]");
+                return;
+            }
+
+            switch (TargetResource.Mode)
             {
                 case 0:
                     if (PermissionIntegration.HasValidRequirement(Peer, PermNodes.ResourceUnloadProp) == false)