openvibers/source.openvibe.games Commits

Phase 5: networked Q-menu spawn via net library

CO Copilot committed 2 Jul 2026 · c7797063fc · 1 file, +15 −0

Sandbox registers net.Receive('OV_Sandbox_Spawn'): a client sends the
chosen prop id with the net library and the server spawns it. spawnProp
validates the id against the allowlist first, so the client's value is
never trusted (per the GMod net guide). Client transport today is the
ov_net C++ forwarder (bindable); becomes net.SendToServer once the
client JS runtime lands.

Verified (mocked runtime): valid id -> ov_fortwars_spawn; invalid id
rejected.

Changes

ddiff --git a/game/openvibe.games/js/gamemodes/sandbox/server.js b/game/openvibe.games/js/gamemodes/sandbox/server.js
iindex 9bf8bca..9642b75 100644
---- a/game/openvibe.games/js/gamemodes/sandbox/server.js
++++ b/game/openvibe.games/js/gamemodes/sandbox/server.js
@@@ -94,6 +94,20 @@
      });
    }
  
++  // Networked Q-menu spawn: the client sends the chosen prop via the net
++  // library (ov_net OV_Sandbox_Spawn <payload>). spawnProp already validates
++  // the prop id against the allowlist, so we never trust the client's value.
++  function registerNet() {
++    if (!globalThis.net) return;
++    util.AddNetworkString("OV_Sandbox_Spawn");
++    net.Receive("OV_Sandbox_Spawn", function (len, ply) {
++      var id = net.ReadString();
++      if (!ply) { OV.warn("OV_Sandbox_Spawn with no player; ignoring"); return; }
++      spawnProp(ply, id);
++    });
++    OV.log("sandbox: net.Receive('OV_Sandbox_Spawn') ready");
++  }
++
    const GM = {
      mode: "sandbox",
      name: "OpenVibe Sandbox",
@@@ -101,6 +115,7 @@
      Initialize() {
        OV.log("Sandbox Initialize fired");
        registerCommands();
++      registerNet();
        ensureBuildEnabled();
      },