Refusing to download a path with ..

[serge]

I've been getting this message in the Quake II console when my map loads after I compile it.
Does anyone know what this means?

Thx!

[sP1Sp0pD]

These messages could come from functions CL_Download_f() and CL_CheckOrDownloadFile(), defined in client/cl_parse.c. Usually, Quake will attempt to download resources that are missing on your computer, but if their path contains reference to upper directory (that is double dot, ".."), I would guess it suspects that something fishy might be going on, and refuses to proceed for security's sake.

You should make sure that your map does not use or reference any textures with those kind of bogus names. On Unix-like systems, an easy way to check this is by using grep(1) over the .map source file, or grepping strings(1) output from the compiled .bsp file.

[knightmare]

This check against ".." in download paths in the client was likely done to protect against servers stuffing download commands for DLL files in the game's root folder. Without this check, the download command could have been exploited to make clients download and execute a renderer module with malicious code.

There's a similar check on the server side to prevent clients from downloading stuff like the server config files.

On Windows, you can just open the .map file in WordPad and search for "..", without the quotes.

[serge]

Great, I'll look into it. Thanks for the help.

Update: I've searched the .map file for ..
Couldn't find it.

I'm not sure what caused it because I've tested the map many times during development and never got that message.
Only when I added the final area of the map it started occurring.
I didn't use any new custom textures since the last successful build.
---
Update 2: The project consists of 2 maps. The problem occurs on the second map.
If I load the first map and reach the end and the second map loads it doesn't happen.

Could it be because I've used a crosslevel trigger/target?

[knightmare]

Did you add a tank commander monster, maybe with a custom skin variant (set with the style key) using the Lazarus mod? I remembered that the skins for that tank variant are in a folder in baseq2/pak0.pak called "models/monsters/tank/../ctank", and the Lazarus custom skin code keeps that weird path. Yes, id screwed something up in Q2's files.

You should be able to make this message go away by removing the style key from the tank commander(s) and deleting the patched monster model, adding dummy skins for the custom skins added by Lazarus, or turning off autodownloading of models.

[serge]

There's one Tank Commander in the map but I don't use any mods or style variants.
I didn't edit any properties of that entity.

I get the message twice when loading the map so I suppose there must be two different things causing it.
Very strange...

[knightmare]

The tank commander has 2 skins with that bad path, so the message will appear twice. The client runs CL_CheckOrDownloadFile() on every skin of every model (among lots of other things), so that's where it's coming from.

You should just disable autodownloading. It's a hacked-in feature that was added in a later patch (3.19) and shouldn't be used during a single-player game, anyway. The next release of my unofficial Q2 patch will completely skip it when running a single-player game and when you play on your own server in multiplayer.

[serge]

Ok, thanks for your help!