Pryaxis/TShock v4.5.6

TShock 4.5.6 (Terraria 1.4.3.0)

on GitHub

This release includes protocol compatibility with Terraria 1.4.3.0.

This release includes a security fix for GHSA-6w5v-hxr3-m2wx. The details around of vulnerability and additional patches will be provided as a defense-in-depth measure in the next release. This security advisory will be made public and additional patches provided on Tuesday, November 23rd, at 22:00 MST.

Notable changes

• Updated Linux guide. (@NezbednikSK)
• Fixed SendTileRectHandler not sending tile rect updates like Pylons/Mannequins to other clients. (@Stealownz)
• Introduced SoftcoreOnly config option to allow only softcore characters to connect. (@drunderscore)
• Fixed some typos that have been in the repository for over a lustrum. (@Killia0)
• Added a tshock.npc.summonboss permission check for Lunatic Cultist, players who do not have this permission will not be able to kill Cultist Archers/Devotees to summon the Lunatic Cultist. (@moisterrific)
• Added more usage examples for the ban command under ban help examples to explain how users can ban: offline players by account, offline players by IP, and online players by player index - useful for banning hard to type character names. (@moisterrific)
• Changed /login and /register to provide login help depending on if UUID login is enabled or disabled, and whether or not a player can login via any username or not. In addition, the message parameters will now be differentiated by colour instead of <> (@moisterrific, @hakusaro)
• Added a new DisablePrimeBombs config option (false by default). Highly recommended to set this to true in order to prevent griefing on servers doing a for the worthy play-through, since the prime bombs on this seed can destroy most tiles and bypass region protection. (@moisterrific)
• Added a new /respawn command that lets you respawn yourself or another player. Respawning yourself requires the tshock.respawn permission and respawning others requires the tshock.respawn.other permission. The full command syntax is /respawn [player]. (@moisterrific)
• Added a notification message and silent command support for permanently changing a target player's user group. Now players who received a group change will be notified of their new group if they are currently online. (@moisterrific, @QuiCM)
• Changed the TSPlayer IP method to return the loopback IP if RealPlayer is false. (@Rozen4334)
• Fixed a bug that caused sundials to be ignored all the time, instead of only when the player has no permission or time is frozen. (@Rozen4334)
• Added colours and usage examples (similiar to how the new ban system looks) for many more commands. (@moisterrific)
• Changed RespawnSeconds and RespawnBossSeconds from 10 to 0 to respect the game's default respawn timers. (@moisterrific)
• Updated Open Terraria API (OTAPI) and TSAPI for preliminary support of Terraria 1.4.3.0. This functionally changes OTAPI and points to 2.0.0.45 from 2.0.0.43 in previous versions. Developer note: SendData takes an extra arg in this version of Terraria but that's slated to be removed in a Terraria hotfix. This is vestigial and OTAPI "hacks that out" to preserve plugin compatibility. That's why it'll differ from the source code. (@Patrikkk, @DeathCradle, honorable mention: @Moneylover3246)
• Added Deerclops to /spawnboss command. (@hakusaro, @HiddenStriker)
• Fixed GHSA-6w5v-hxr3-m2wx. (@Yoraiz0r, @Arthri)
• Fixed an issue where player build permissions would reject gem lock changes, even if RegionProtectGemLocks was disabled in the config file. Now, players will be permitted to use gem locks if they don't have build permission in a region, but RegionProtectGemLocks is disabled. If RegionProtectGemLocks is enabled, players will be unable to use gem locks in a build region. (@hakusaro, @Kojirremer, @Arthri)
• Fixed an issue where /god [player] would tell [player] that they were in godmode regardless of whether or not they were or not. (@hakusaro, @Kojirremer)
• In TSAPI: Updated PacketTypes to support SetMiscEventValues (140), RequestLucyPopup (141), and SyncProjectileTrackers (142). (@hakusaro)
• Added DisableDefaultIPBan to the config file. If set to true, the server will not automatically IP ban players when banning them. This is useful if you run an intercepting proxy in front of TShock, and all players share the same IP. (@hakusaro, and Telegram user xmzzhh233)
• Blank passwords will be upgraded to bcrypt hashes automatically. Previously, blank passwords were not upgraded to bcrypt hashes. This is in preparation to remove the old password hashing system and related fallback components in the next release. Most users have been using bcrypt hashes for the past...few years. (@hakusaro)

Updating

To update TShock, simply replace all of the files in your server folder with those from the release folder.