An update for Counter-Strike is now available:

• Fixed viewdemo command crashing for certain demo files
  
• Fixed ammo boxes visibly spawning when purchasing ammo
  
• Security fix to client disconnect handling
  
• Security fixes to console command handling
  
• Security fix to client/server communications
  
• Security fix to model loading
  
• Security fixes to BSP and WAD loading
  
• Setting _cl_autowepswitch to 2 will now enable auto weapon switching on pickup of a better weapon except when holding Primary or Secondary attack

A small Counter-Strike update is now available that fixes some issues identified after the last release.

General

• Fixed crash when playing back certain demos recorded on older server versions
  
• Fixed some resources not downloading properly through FastDL
  
• Fixed gl_texturemode and gl_ansio not updating properly when enabling/disabling Low video quality mode

An update for Counter-Strike is now available:

• Prevent texgamma and lightgamma and brightness cvars from affecting lighting in multiplayer
  
• Added support for player avatars in scoreboard for lower display resolutions
  
• Added scoreboard cvar to show shortened, simple headers for columns: scoreboard_shortheaders, set to 0/1 to disable/enable
  
• Added scoreboard cvar to enable/disable showing avatars: scoreboard_showavatars, set to 0/1 to disable/enable
  
• Added new server cvar, mp_infinite_ammo, set to 0 to disable, 1 for infinite ammo in guns, 2 for infinite reload ammo

• Added money and health columns to scoreboard and player/server cvars to control their display
  
  • Player cvars are: scoreboard_showhealth and scoreboard_showmoney, can be set to 0/1 to disable/enable the column from showing
    
  • Server cvars are: mp_scoreboard_showhealth and mp_scoreboard_showmoney, they can be set to the following values:
    
    Value

    Description

    0

    Disable showing health/money altogether

    1

    Show Terrorist health/money to all teams

    2

    Show CT health/money to all teams

    3 (default)

    Show CT health/money to teammates only and Terrorist health/money to teammates only

    4

    Show health/money for all players to all other players

    5

    Show CT and T health/money to teammates and to spectators

• Fixed shotgun shell reload delay when holding +attack while magazine is empty
  
• Fixed non-translucent crosshair being slightly off-center
  
• Fixed UMP45 +attack being canceled when +attack2 is pressed

• Fixed setting monitor refresh rates through -freq when used with -nofbo
  
• Fixed unnecessary texture rescaling with NPOT textures
  
• Fixed slist command, will now show servers on the local network
  
• Fixed progress bar for individual files in resource download always showing at 100%
  
• Added auto-saving of several cvars (HL #2237)
  
• Fixed missing localizations in spectator UI
  
• Reordered columns in server browser to prevent game descriptions from being used to fake server player count
  
• Fixed sv_cheats being settable by players in a multiplayer game (sv_cheats is now controlled by the server)
  
• Security fixes to console commands
  
• Security fixes to resource loading

This list covers the releases between March 20 and April 11 that are each part of a series of security updates.

Larger changes:

• Added privilege checking to command execution. Commands originating outside of the client are now only able to execute commands that are considered to be safe. Commands such as 'connect', 'bind', 'quit' and certain cvars such as 'cl_filterstuffcmd' are now only executable by trusted sources.
  
• Setting 'cl_filterstuffcmd' to a value greater than zero (e.g. 'cl_filterstuffcmd 1') will set a number of commands that are potentially abusable, such as 'say', 'fps_max', and 'setinfo', to also be only executable by privileged sources.

Fixes:

• Fixed client incorrectly blocking download of custom sprays

Security fixes:

• All custom resources downloaded from a server now have their file name's checked for safety before being allowed to download
  
• Invalid file extensions are now prevented in several commands
  
• Dynamic libraries are no longer searched for in custom resource directories
  
• Added additional file extensions to custom resource blocked extensions list
  
• Fixed buffer overflow in message delta parsing
  
• Fixed RCE in weapon message handling
  
• Fixed RCE in model loading
  
• Fixed buffer overflows in TGA and BMP loading
  
• Fixed buffer overflow in demo playback
  
• Fixed buffer overflows in model name loading
  
• Fixed buffer overflow in detail texture loading
  
• Fixed buffer overflow in console map listing
  
• Fixed command chaining in cvar's that specified config files to be passed to the 'exec' command

A small update for Counter-Strike is now available:

Engine

• Fixed bug in skybox image loading
  
• Fixed bug in demo command processing
  
• Prevent certain path characters from being used in commands
  
• Enforce certain extensions be used for files specified in some commands

Counter-Strike 1.6 update released


We have updated the public release of Counter-Strike 1.6.

Changes in this update are:

• Fixed crash when entering certain malformed strings into the game console. Thanks to Marshal Webb from BackConnect, Inc for reporting this.
  
• Fixed crash when loading a specially crafted malformed BSP file. Thanks to Grant Hernandez (@Digital_Cold) for reporting this.
  
• Fixed malformed SAV files allowing arbitrary files to be written into the game folder. Thanks to Vsevolod Saj for reporting this.
  
• Fixed a crash when quickly changing weapons that are consumable. Thanks to Sam Vanheer for reporting this.
  
• Fixed crash when setting custom decals
  
• Make sure the Close button has keyboard focus when you see the disconnection dialog
  
• Disable showing of popup html windows
  
• Made the play command obey speak_enabled cvar
  
• Fixed being unable to pickup a primary weapon if you had an ammox box object previously stip you of items
  
• Fixed room type not being updated on map change/connect
  
• Fixed out of date information showing in the scoreboard after level change or changing servers
  
• Fixed the specator UI to not show a placeholder name when initially shown
  
• Fixed sprays not loading from the correct path causing them not to update
  
• Fixed the Condition Zero tours ui to display the tour number correctly when you have more than 9 entries
  
• Fixed crash if you issued a changelevel command on a local server while certain UI elements were visible

Counter-Strike 1.6 update released


We have updated the public release of Counter-Strike 1.6.

Changes in this update are:

• Fixed crash when entering certain malformed strings into the game console. Thanks to Marshal Webb from BackConnect, Inc for reporting this.
  
• Fixed crash when loading a specially crafted malformed BSP file. Thanks to Grant Hernandez (@Digital_Cold) for reporting this.
  
• Fixed malformed SAV files allowing arbitrary files to be written into the game folder. Thanks to Vsevolod Saj for reporting this.
  
• Fixed a crash when quickly changing weapons that are consumable. Thanks to Sam Vanheer for reporting this.
  
• Fixed crash when setting custom decals
  
• Make sure the Close button has keyboard focus when you see the disconnection dialog
  
• Disable showing of popup html windows
  
• Made the play command obey speak_enabled cvar
  
• Fixed being unable to pickup a primary weapon if you had an ammox box object previously stip you of items
  
• Fixed room type not being updated on map change/connect
  
• Fixed out of date information showing in the scoreboard after level change or changing servers
  
• Fixed the specator UI to not show a placeholder name when initially shown
  
• Fixed sprays not loading from the correct path causing them not to update
  
• Fixed the Condition Zero tours ui to display the tour number correctly when you have more than 9 entries
  
• Fixed crash if you issued a changelevel command on a local server while certain UI elements were visible

We have released a Beta update for Counter-Strike 1.6.
Changes in this update are:

• Make sure the Close button has keyboard focus when you see the disconnection dialog
  
• Disable showing of popup html windows
  
• Made the play command obey speak_enabled cvar
  
• Fixed being unable to pickup a primary weapon if you had an ammox box object previously stip you of items
  
• Fixed room type not being updated on map change/connect
  
• Fixed out of date information showing in the scoreboard after level change or changing servers
  
• Fixed the specator UI to not show a placeholder name when initially shown
  
• Fixed sprays not loading from the correct path causing them not to update
  
• Fixed the Condition Zero tours ui to display the tour number correctly when you have more than 9 entries
  
• Fixed crash if you issued a changelevel command on a local server while certain UI elements were visible

We have released a Beta update for Counter-Strike 1.6.
Changes in this update are:

• Make sure the Close button has keyboard focus when you see the disconnection dialog
  
• Disable showing of popup html windows
  
• Made the play command obey speak_enabled cvar
  
• Fixed being unable to pickup a primary weapon if you had an ammox box object previously stip you of items
  
• Fixed room type not being updated on map change/connect
  
• Fixed out of date information showing in the scoreboard after level change or changing servers
  
• Fixed the specator UI to not show a placeholder name when initially shown
  
• Fixed sprays not loading from the correct path causing them not to update
  
• Fixed the Condition Zero tours ui to display the tour number correctly when you have more than 9 entries
  
• Fixed crash if you issued a changelevel command on a local server while certain UI elements were visible

We have updated the public release of Counter-Strike. This update contains all the changes from the recent beta, thanks to the whole community for their help with testing and suggesting new features.

Changes in this update are:

<ul>
<li>Fixed dedicated server logs so they don't go into _addon or _download folders by mistake
<li>Fixed crash due to pointer double free in Counter-Strike 1.6
<li>Fixed console spam if a user connected with a particularly malformed UTF-8 name
<li>Fixed "bomb has been dropped" message staying on the screen
<li>Made keypad Enter key work for MOTD, team and class menus
<li>Clamped health values to fix display issues when it dropped below 1 or above 255
<li>Fixed non-latin names being corrupted in voice labels
<li>Fixed HTML form control elements not rendering correctly in the MOTD
<li>Fix the snapshot command in the software mode renderer, and change the screenshot command in the software renderer to produce TGA files
<li>Fixed test microphone button not working correctly
<li>Fixed crash in demoplayer when using invalid time offsets
<li>Fixed crash when spamming grenades while having the M3 purchased
<li>Fixed buy menu not working with shortcut keys if caps lock was enabled
</ul>