A small but important hotfix on top of v0.60.6. One critical security fix (a non-admin user could delete another player's save file via a hidden command) and one new admin feature (server-wide permadeath / resurrection controls so sysops running their own MUD server can pick the death model their server uses).
Same player who responsibly disclosed the v0.60.5 trusted-AUTH bypass also flagged this one: typing the bare word settings or config from the Main Street prompt (with no leading slash, no menu hint, no documentation) opened a hidden "SETTINGS & SAVE OPTIONS" menu. The menu exposed all-players save management: Load Different Save, Delete Save Files, View Save File Information, Force Daily Reset, Change Daily Cycle Mode. In MUD or online mode, any non-admin user could use this to delete the admin's save file, or any other player's save.
The repro was: in MUD mode, register a regular user account. Type settings or config from Main Street as that non-admin user. Pick "Delete Save Files." Pick the admin's save. Gone.
The menu was originally a single-player save-management UI from the desktop / standalone build. When MUD mode was added, the bare-word handler for these commands was never gated, so it stayed reachable globally. The visible [~] Settings hotkey on Main Street has always routed to the SAFE per-player preferences menu (combat speed, auto-heal, intimate scenes), which is the only thing players ever needed from "settings." The dangerous all-players menu had no visible entry point at all, only the hidden bare-word command, which functioned as an undocumented backdoor.
A v0.60.6 attempt removed the bare-word settings / set cases from one source file but missed a duplicate override in another. The reporter retested on the live server post-deploy and showed the menu still opening via config.
The fix: the dangerous menu and all of its helper methods are deleted entirely (594 lines removed). No code path can reach the all-players save-management UI from any context. The visible [~] Settings hotkey continues to work and routes to the safe per-player preferences as before.
What this means for you:
Thanks again to the reporter for two responsible disclosures in two releases. Persistence and care, exactly the right way to do this.
Sysops running their own MUD server now have two new knobs in the Online Admin Console under Resurrection / Permadeath Settings:
Permadeath ENABLED (default): each death consumes one resurrection. At zero, the next death erases the character permanently with a server-wide red broadcast and a news entry. This is the live-server beta default and matches v0.60.6 behaviour exactly.
Permadeath DISABLED: online deaths route through the legacy single-player penalty menu (Temple, Deal with Death, Accept Fate). The Resurrections counter is no longer consulted. No character is ever erased regardless of how many times they die. This is "softcore" mode for sysops who want a more forgiving server.
Both settings persist in a new SQLite table on the server, are auto-loaded into the game on startup, and survive restart. The admin UI shows the current values, prompts for confirmation on the permadeath toggle (since flipping it changes how every player's next death plays out), and writes an audit log line on every change.
This only affects MUD-server admins. Regular players see no UI change. Default behaviour matches v0.60.6 exactly. The new controls only kick in when a sysop explicitly opens the admin console and changes them.
The new server_config SQLite table is created via CREATE TABLE IF NOT EXISTS on first MUD-server startup post-deploy. No manual SQL needed. Empty table on first boot means both settings stay at their defaults (3 resurrections, permadeath enabled).
Beta is live. Bug reports and feedback always welcome. Press the ! key in-game or type /bug to report. See you in there.