ready to deploy

Author: dooly123

Basis Server/BasisNetworkServer/Core/BasisServerHandleEvents.cs

@@ -767,7 +767,8 @@ public static void SendAvatarMessageToClients(NetPacketReader Reader, NetPeer Pe
             ClientAvatarChangeMessage.Deserialize(Reader);
             Reader.Recycle();
 
-            // Global avatar lock: reject network broadcast but still save state locally
+            // Global avatar lock: drop the change outright — neither broadcast nor saved, so a
+            // late joiner isn't handed an avatar the lock exists to keep out of the instance.
             if (BasisNetworkServer.Security.BasisGlobalLockManager.AvatarsLocked)
             {
                 bool hasBypass = false;

Basis Server/BasisNetworkServer/Security/BasisGlobalLockManager.cs

@@ -1,4 +1,4 @@
-using Basis.Network.Core;
+using Basis.Network.Core;
 using System.Threading;
 using static BasisNetworkCore.Serializable.SerializableBasis;
 
@@ -77,6 +77,38 @@ public static void InitializeFromConfig(Configuration config)
             Interlocked.Exchange(ref _endEffectorIKDisabled, config.EndEffectorIKDisabled ? 1 : 0);
         }
 
+        /// <summary>
+        /// Copies the live lock state back onto the configuration object so a caller can persist it
+        /// to config.xml. The mirror image of <see cref="InitializeFromConfig"/> — every field that
+        /// seeds a flag at boot is written here, or an admin's toggle silently reverts on restart.
+        /// </summary>
+        public static void WriteToConfig(Configuration config)
+        {
+            if (config == null)
+            {
+                return;
+            }
+
+            config.AvatarsLocked = AvatarsLocked;
+            config.PropsLocked = PropsLocked;
+            config.WorldsLocked = WorldsLocked;
+            config.ServersLocked = ServersLocked;
+            config.ThirdPersonDisabled = ThirdPersonDisabled;
+            config.AdditionalAvatarDataLock = AdditionalAvatarDataLock;
+            config.CameraMetadataDisallowMask = CameraMetadataDisallowMask;
+            config.PlayspaceMoverLocked = PlayspaceMoverLocked;
+            config.DirectConnectLocked = DirectConnectLocked;
+            config.CilboxLocked = CilboxLocked;
+            config.ImagesLocked = ImagesLocked;
+            config.TextChatLocked = TextChatLocked;
+            config.VoiceChatLocked = VoiceChatLocked;
+            config.MediaPlayerLocked = MediaPlayerLocked;
+            config.CameraCaptureLocked = CameraCaptureLocked;
+            config.PropGrabbingLocked = PropGrabbingLocked;
+            config.SafeDisplayNamesForced = SafeDisplayNamesForced;
+            config.EndEffectorIKDisabled = EndEffectorIKDisabled;
+        }
+
         /// <summary>
         /// Toggle avatar loading. Returns the new state (true = locked).
         /// </summary>

Basis Server/BasisNetworkServer/Security/BasisPlayerModeration.cs

@@ -370,7 +370,7 @@ public static void OnAdminMessage(NetPeer peer, NetPacketReader reader)
 
                 case AdminRequestMode.GlobalToggleThirdPerson:
                     Require(peer, PermNodes.ModerationGlobalLock, () =>
-                        HandleGlobalToggle(peer, "Third-person camera", BasisGlobalLockManager.ToggleThirdPerson()));
+                        HandleGlobalFeatureToggle(peer, "The third-person camera", BasisGlobalLockManager.ToggleThirdPerson()));
                     break;
 
                 case AdminRequestMode.GlobalToggleAdditionalAvatarDataLock:
@@ -418,7 +418,7 @@ public static void OnAdminMessage(NetPeer peer, NetPacketReader reader)
 
                 case AdminRequestMode.GlobalToggleCilbox:
                     Require(peer, PermNodes.ModerationGlobalLock, () =>
-                        HandleGlobalToggle(peer, "Avatar Cilbox code", BasisGlobalLockManager.ToggleCilbox()));
+                        HandleGlobalFeatureToggle(peer, "Avatar Cilbox code", BasisGlobalLockManager.ToggleCilbox()));
                     break;
 
                 case AdminRequestMode.GlobalToggleImages:
@@ -428,37 +428,37 @@ public static void OnAdminMessage(NetPeer peer, NetPacketReader reader)
 
                 case AdminRequestMode.GlobalToggleEndEffectorIK:
                     Require(peer, PermNodes.ModerationGlobalLock, () =>
-                        HandleGlobalToggle(peer, "Remote end-effector IK", BasisGlobalLockManager.ToggleEndEffectorIK()));
+                        HandleGlobalFeatureToggle(peer, "Remote end-effector IK", BasisGlobalLockManager.ToggleEndEffectorIK()));
                     break;
 
                 case AdminRequestMode.GlobalToggleTextChat:
                     Require(peer, PermNodes.ModerationGlobalLock, () =>
-                        HandleGlobalToggle(peer, "Text chat", BasisGlobalLockManager.ToggleTextChat()));
+                        HandleGlobalFeatureToggle(peer, "Text chat", BasisGlobalLockManager.ToggleTextChat()));
                     break;
 
                 case AdminRequestMode.GlobalToggleVoiceChat:
                     Require(peer, PermNodes.ModerationGlobalLock, () =>
-                        HandleGlobalToggle(peer, "Voice chat", BasisGlobalLockManager.ToggleVoiceChat()));
+                        HandleGlobalFeatureToggle(peer, "Voice chat", BasisGlobalLockManager.ToggleVoiceChat()));
                     break;
 
                 case AdminRequestMode.GlobalToggleMediaPlayer:
                     Require(peer, PermNodes.ModerationGlobalLock, () =>
-                        HandleGlobalToggle(peer, "Media player", BasisGlobalLockManager.ToggleMediaPlayer()));
+                        HandleGlobalFeatureToggle(peer, "Media players", BasisGlobalLockManager.ToggleMediaPlayer()));
                     break;
 
                 case AdminRequestMode.GlobalToggleCameraCapture:
                     Require(peer, PermNodes.ModerationGlobalLock, () =>
-                        HandleGlobalToggle(peer, "Camera capture", BasisGlobalLockManager.ToggleCameraCapture()));
+                        HandleGlobalFeatureToggle(peer, "Camera capture", BasisGlobalLockManager.ToggleCameraCapture()));
                     break;
 
                 case AdminRequestMode.GlobalTogglePropGrabbing:
                     Require(peer, PermNodes.ModerationGlobalLock, () =>
-                        HandleGlobalToggle(peer, "Prop grabbing", BasisGlobalLockManager.TogglePropGrabbing()));
+                        HandleGlobalFeatureToggle(peer, "Prop grabbing", BasisGlobalLockManager.TogglePropGrabbing()));
                     break;
 
                 case AdminRequestMode.GlobalToggleSafeDisplayNames:
                     Require(peer, PermNodes.ModerationGlobalLock, () =>
-                        HandleGlobalToggle(peer, "Safe display names", BasisGlobalLockManager.ToggleSafeDisplayNames()));
+                        HandleGlobalProtectionToggle(peer, "Safe display names", BasisGlobalLockManager.ToggleSafeDisplayNames()));
                     break;
 
                 case AdminRequestMode.SetGlobalAvatarScaleLimits:
@@ -1267,6 +1267,7 @@ private static void BroadcastGlobalLockNotice(NetPeer peer, string adminReply, s
             NetworkServer.BroadcastMessageToClients(writer, BasisNetworkCommons.AdminChannel, NetworkServer.PeerSnapshot, DeliveryMethod.ReliableOrdered);
             NetworkServer.ReturnWriter(writer);
 
+            PersistGlobalLockState();
             BasisGlobalLockManager.BroadcastLockState();
         }
 
@@ -1276,6 +1277,28 @@ private static void HandleGlobalToggle(NetPeer peer, string contentType, bool no
             HandleGlobalStateNotification(peer, $"{contentType} loading has been globally {state} by an admin.");
         }
 
+        /// <summary>
+        /// Notification for locks over a live feature rather than content loading (chat, voice,
+        /// grabbing, ...). HandleGlobalToggle's "<c>X loading</c>" template reads as nonsense for
+        /// these — nothing is being loaded — so they get a plain "<c>X has been ... DISABLED</c>".
+        /// </summary>
+        private static void HandleGlobalFeatureToggle(NetPeer peer, string featureName, bool nowLocked)
+        {
+            string state = nowLocked ? "DISABLED" : "ENABLED";
+            HandleGlobalStateNotification(peer, $"{featureName} has been globally {state} by an admin.");
+        }
+
+        /// <summary>
+        /// Notification for a protection that is ENABLED when its flag is set — the opposite sense
+        /// to every lock above, so the shared templates would announce the exact inverse of what
+        /// the admin just did.
+        /// </summary>
+        private static void HandleGlobalProtectionToggle(NetPeer peer, string protectionName, bool nowEnforced)
+        {
+            string state = nowEnforced ? "ENABLED" : "DISABLED";
+            HandleGlobalStateNotification(peer, $"{protectionName} has been globally {state} by an admin.");
+        }
+
         /// <summary>
         /// Notifies the toggling admin + all clients with a pre-composed, unambiguous message and
         /// rebroadcasts the lock state. Toggles whose semantics don't fit the
@@ -1297,9 +1320,21 @@ private static void HandleGlobalStateNotification(NetPeer peer, string notificat
             NetworkServer.ReturnWriter(writer);
 
             // Broadcast updated lock state so clients track it
+            PersistGlobalLockState();
             BasisGlobalLockManager.BroadcastLockState();
         }
 
+        /// <summary>
+        /// Mirrors the live global lock state onto Configuration and writes config.xml. Every lock
+        /// seeds itself from config at boot, so a toggle that isn't persisted here silently reverts
+        /// on the next restart.
+        /// </summary>
+        private static void PersistGlobalLockState()
+        {
+            BasisGlobalLockManager.WriteToConfig(NetworkServer.Configuration);
+            SaveConfig();
+        }
+
         private static void HandleHeadlessAudioSet(NetPeer peer, NetPacketReader reader)
         {
             if (reader.AvailableBytes < 1)
@@ -1343,6 +1378,9 @@ private static void HandleHeadlessDisallowSet(NetPeer peer, NetPacketReader read
                 BasisHeadlessConnectionPolicyManager.DisconnectConnectedHeadlessPeers();
             }
 
+            // Seeded from Configuration.DisallowHeadless at boot — persist or it reverts on restart.
+            NetworkServer.Configuration.DisallowHeadless = BasisHeadlessConnectionPolicyManager.HeadlessDisallowed;
+            SaveConfig();
             BasisHeadlessConnectionPolicyManager.BroadcastState();
         }
 
@@ -1378,6 +1416,7 @@ private static void HandleCameraPolicySet(NetPeer peer, NetPacketReader reader)
             BasisGlobalLockManager.SetCameraMetadataDisallowMask(mask);
             BNL.Log($"Camera photo-metadata disallow mask set to {mask}.");
             SendBackMessage(peer, $"Camera metadata policy updated (mask {mask}).");
+            PersistGlobalLockState();
             BasisGlobalLockManager.BroadcastLockState();
         }
 

Basis Server/BasisServerTests/Security/SecurityListAndLockManagerTests.cs

@@ -1,4 +1,4 @@
-using Basis.Network.Core;
+using Basis.Network.Core;
 using Basis.Network.Server.Auth;
 using BasisNetworkCore.Security;
 using BasisNetworkServer.BasisNetworking;
@@ -503,6 +503,7 @@ public class BasisGlobalLockManagerTests
         MediaPlayerLocked = false,
         CameraCaptureLocked = false,
         PropGrabbingLocked = false,
+        SafeDisplayNamesForced = false,
     };
 
     private static Configuration AllLocked() => new()
@@ -524,6 +525,7 @@ public class BasisGlobalLockManagerTests
         MediaPlayerLocked = true,
         CameraCaptureLocked = true,
         PropGrabbingLocked = true,
+        SafeDisplayNamesForced = true,
     };
 
     private static void AssertAllFlags(bool expected)
@@ -544,6 +546,50 @@ private static void AssertAllFlags(bool expected)
         Assert.Equal(expected, BasisGlobalLockManager.MediaPlayerLocked);
         Assert.Equal(expected, BasisGlobalLockManager.CameraCaptureLocked);
         Assert.Equal(expected, BasisGlobalLockManager.PropGrabbingLocked);
+        Assert.Equal(expected, BasisGlobalLockManager.SafeDisplayNamesForced);
+    }
+
+    /// <summary>
+    /// Every lock seeds itself from Configuration at boot, so a toggle that never reaches
+    /// Configuration silently reverts on restart. WriteToConfig is the mirror of
+    /// InitializeFromConfig and must carry every field back — including the mask.
+    /// </summary>
+    [Fact]
+    public void WriteToConfig_RoundTripsEveryFlagAndTheMask()
+    {
+        try
+        {
+            BasisGlobalLockManager.InitializeFromConfig(AllLocked());
+
+            Configuration persisted = AllUnlocked();
+            BasisGlobalLockManager.WriteToConfig(persisted);
+
+            // Reseeding from what was written must reproduce the state that was written out.
+            BasisGlobalLockManager.InitializeFromConfig(AllUnlocked());
+            AssertAllFlags(false);
+            BasisGlobalLockManager.InitializeFromConfig(persisted);
+            AssertAllFlags(true);
+            Assert.Equal(0xAB, BasisGlobalLockManager.CameraMetadataDisallowMask);
+        }
+        finally
+        {
+            BasisGlobalLockManager.InitializeFromConfig(AllUnlocked());
+        }
+    }
+
+    [Fact]
+    public void WriteToConfig_IgnoresANullConfiguration()
+    {
+        BasisGlobalLockManager.InitializeFromConfig(AllLocked());
+        try
+        {
+            BasisGlobalLockManager.WriteToConfig(null);
+            AssertAllFlags(true);
+        }
+        finally
+        {
+            BasisGlobalLockManager.InitializeFromConfig(AllUnlocked());
+        }
     }
 
     [Fact]

Basis/Packages/com.basis.camera/Runtime/BasisHandHeldCamera.cs

@@ -1,4 +1,4 @@
-using Basis;
+using Basis;
 using Basis.BasisUI;
 using Basis.ImagePickup;
 using Basis.Scripts.Audio;
@@ -1215,6 +1215,14 @@ public void Timer()
             return;
         }
 
+        // Same gate CapturePhoto applies: the timer is just a delayed capture, so a locked client
+        // must not start one — and must not broadcast the countdown remotes replay.
+        if (BasisNetworkModeration.CameraCaptureBlockedLocally)
+        {
+            BasisDebug.LogWarning("Timer blocked: camera capture is locked by an admin.", BasisDebug.LogTag.Camera);
+            return;
+        }
+
         // Notify remote clients so they replay the same tick/shutter timing
         if (BasisNetworkConnection.LocalPlayerPeer != null)
         {
@@ -1255,6 +1263,18 @@ private IEnumerator DelayedAction(float delaySeconds)
         countdownText.text = "!";
         yield return new WaitForSeconds(0.5f);
 
+        countdownRoutine = null;
+
+        // Re-checked here because an admin can lock capture during the countdown, and before the
+        // shutter sound for the same reason CapturePhoto checks early: a refusal must not sound
+        // like a photo was taken.
+        if (BasisNetworkModeration.CameraCaptureBlockedLocally)
+        {
+            BasisDebug.LogWarning("Timer capture blocked: camera capture is locked by an admin.", BasisDebug.LogTag.Camera);
+            countdownText.text = string.Empty;
+            yield break;
+        }
+
         // Choose formats based on captureFormat
         GetCaptureFormats(out TextureFormat format, out RenderTextureFormat renderFormat);
 
@@ -1264,8 +1284,6 @@ private IEnumerator DelayedAction(float delaySeconds)
             BasisUISounds.PlayAt(BasisUISoundEvent.CameraShutter, BasisDeviceManagement.Instance.CameraShutterSound, captureCamera.transform.position, SMModuleAudio.ActivePropVolume);
         }
 
-        countdownRoutine = null;
-
         if (capture360Enabled)
             StartCoroutine(TakeScreenshot360(captureFormat == "EXR"));
         else