An exploit was released last night that took advantage of the Source Engine’s file sending mechanism which made it possible to send files with any extension to the client or server. This exploit is likely still active in all other Source Engine games so we’re not going to go into specific details about it.

Needless to say that this was exploited in Garry’s Mod on Windows to send dlls to clients and servers. As far as we are aware the exploit wasn’t used to do anything malicious beyond propagating itself, spamming chat and changing server names. But to be safe we recommend that you consider deleting your Garry’s Mod install and starting fresh. It might be a good idea to do an online virus scan too.
The patch we released this morning attempts to clean up any mess left behind by these exploits and patches the variety of methods which they used. If anyone has further information about the exploits, or any exploits left un-patched please email Garry Newman personally at garrynewman@gmail.com.

An exploit was released last night that took advantage of the Source Engine’s file sending mechanism which made it possible to send files with any extension to the client or server. This exploit is likely still active in all other Source Engine games so we’re not going to go into specific details about it.

Needless to say that this was exploited in Garry’s Mod on Windows to send dlls to clients and servers. As far as we are aware the exploit wasn’t used to do anything malicious beyond propagating itself, spamming chat and changing server names. But to be safe we recommend that you consider deleting your Garry’s Mod install and starting fresh. It might be a good idea to do an online virus scan too.
The patch we released this morning attempts to clean up any mess left behind by these exploits and patches the variety of methods which they used. If anyone has further information about the exploits, or any exploits left un-patched please email Garry Newman personally at garrynewman@gmail.com.

Here are a few quick fixes for the issues introduced by yesterday's update. Servers will need to be restarted.
Some known issues remain and will be addressed next week.

• TTT: Fixed ironsights being broken due to changes from last update
  
• Fixed .mp3 and .ogg playback becoming very expensive due to changes from last update
  
• Fixed Father Grigori not being the king of animals
  
• Entity:FireBullets no longer inflicts ammo-specific damage if the damage is 0 unless an ammo type is explicitly specified
  
• IGModAudioChannel:SetTime now prints a warning if it is called on a non block streamed channel
  
• Added IGModAudioChannel:IsBlockStreamed

Here are a few quick fixes for the issues introduced by yesterday's update. Servers will need to be restarted.
Some known issues remain and will be addressed next week.

• TTT: Fixed ironsights being broken due to changes from last update
  
• Fixed .mp3 and .ogg playback becoming very expensive due to changes from last update
  
• Fixed Father Grigori not being the king of animals
  
• Entity:FireBullets no longer inflicts ammo-specific damage if the damage is 0 unless an ammo type is explicitly specified
  
• IGModAudioChannel:SetTime now prints a warning if it is called on a non block streamed channel
  
• Added IGModAudioChannel:IsBlockStreamed

Due to character limits, the list below does not include changes contributed by the community.
The full changelog can be found here.

FIXES

• Fixed viewmodel bobbing snapping when jumping or noclipping
  
• Fixed flashlight getting duplicated when receiving a full packet update
  
• Fixed spawnicons not always regenerating at the correct resolution when resized
  
• Fixed lamps projecting backwards!
  
• Fixed gamemode name reported by Steam not being updated after a changelevel
  
• Fixed key bindings not working correctly in the main menu
  
• Fixed GMod decals not working when used on props
  
• Fixed debug textures not being precached
  
• Fixed rendering artifacts when some particle effects are rendered in front of the skybox
  
• Fixed nav files remaining open after loading a map
  
• Fixed shell ejection issues on the HL2 pistol and SMG
  
• Fixed viewmodel jittering when overwriting viewmodel position
  
• Fixed viewmodel prediction errors when switching to thirdperson and back
  
• Fixed sound spam with weapon_rpg when no ammo is left
  
• Fixed jigglebones occasionally snapping into impossible positions when rapidly moving
  
• Fixed keyframe_rope ignoring attachment points
  
• Fixed combine balls not colliding with players
  
• Fixed env_zoom not working at all
  
• Fixed metrocops holding the stunstick going into a T-pose when attacked
  
• Fixed metrocops not turning their stunstick on before attacking
  
• Fixed NPCs not receiving the appropriate amount of damage from HL2 weapons

IMPROVEMENTS

• Improved mounting system
  
• sv_kickerrornum now defaults to 0 and its value is now saved to the config file
  
• sv_allowcslua is now saved to the config file
  
• Clientside Lua is now always allowed in singleplayer
  
• Improved some spawn icons
  
• TextEntry panels no longer filter '\t' characters
  
• Restored old damage force behaviour
  
• Singleplayer jump boost from HL2 is now implemented in Lua as a sandbox feature

ADDITIONS

• Added clientside convar cl_steamoverlay_pos

LUA SCRIPTING

• Fixes
  
  • Fixed render.SetStencilWriteMask setting the test mask instead of the write mask
    
  • Fixed CLuaEmitter:Finish not freeing the emitter
    
  • Fixed util.TableToJSON not encoding floating point values with enough accuracy
    
  • Fixed Player:ScreenFade not taking color alpha into account
    
  • Fixed GM:GravGunPickupAllowed not preventing the gravity gun from trying to pick up forbidden entities
    
  • Fixed GM:GravGunPunt not being called clientside when holding an object
    
  • Fixed CSoundPatch:Stop not actually stopping the sound when the game is paused
    
  • Fixed memory leak when calling timer.Create on an already existing timer
    
  • Fixed surface.GetTextSize ignoring '&'
    
  • Fixed the gravity gun and crowbar being removed when dropped using Player:DropWeapon
    
  • Partially fixed functions from the render and surface library not writing alpha when drawing on a render target
    
  • Fixed Entity:GibBreakClient not taking skin number into account
    
  • Fixed Entity:MapCreationID returning different values after a map cleanup
    
  • Fixed NEXTBOT:Use not being called
    
  • Fixed panels not feeding mousewheel events to their parent if the PANEL:OnMouseWheeled hook is defined
    
  • Fixed long-term performance issues with Entity:Remove
    
  • Fixed Entity:EnableMatrix not propagating matrix transform to child bones
    
  • Fixed an exploit with require, Player:ConCommand and game.ConsoleCommand
    
  • Fixed nan and +/-infinity returning a non null terminated string when converted into a string
    
  • Fixed Pre/PostDrawOpaqueRenderables receiving incorrect arguments
    
  • Fixed file functions not working with file names containing certain special characters
    
  • Fixed VMatrix:SetAnglesnot preserving translation and scale
    
  • Fixed surface.CreateFont disconnecting clients when an invalid table is passed
• Improvements
  
  • HTTP requests now accept a "headers" table
    
  • game.AddDecal now accepts a string table as its second argument
    
  • Entity:IsValid no longer returns true on entities which have been removed during the current frame
    
  • Player:LagCompensation should now work in any predicted hook
    
  • Changed GM:CalcViewModelView, return a position and an angle to override viewmodel position
    
  • vm_origin and vm_angles fields in table returned from GM:CalcView are now deprecated
    
  • sound.PlayURL second parameter can now contain the “noblock” flag, which disables streaming in blocks
    
  • IGModAudioChannel:Stop now permanently deletes the channel
    
  • IGModAudioChannel:SetPos now takes an orientation vector as an optional second argument
    
  • Improved command blacklisting for Player:ConCommand and game.ConsoleCommand
    
  • sound.Add now accepts a table as its pitch and volume parameters
    
  • Moved Vector:__unm from Lua to C
    
  • Moved Angle:__unm from Lua to C
    
  • Matrix can now take an optional 4x4 table as an argument
    
  • Matrices can now be multiplied by vectors
    
  • Player:ViewPunchReset first argument is now optional (defaults to 0)
    
  • All trace functions from the util library now accept an ‘ignoreworld’ boolean parameter in their trace data
    
  • net.Start now starts an unreliable message if its second argument is true
    
  • Changed Entity:DispatchTraceAttack arguments to (dmginfo, traceres, dir)
• Additions
  
  • Added chat.Open
    
  • Added chat.Close
    
  • Added render.SetLightmapTexture
    
  • Added render.PushRenderTarget
    
  • Added render.PopRenderTarget
    
  • Added GM:EntityEmitSound
    
  • Added NEXTBOT:OnRemove
    
  • Added timer.TimeLeft and timer.RepsLeft
    
  • Added render.OverrideAlphaWriteEnable
    
  • Added render.OverrideColorWriteEnable
    
  • Added render.SetWriteDepthToDestAlpha
    
  • Added a few requested ACT enums
    
  • Added PANEL:OnRemove hook
    
  • Removed PANEL:OnDeletion hook
    
  • Replaced Entity:GetTextures with Entity:GetMaterials
    
  • Added IGModAudioChannel:GetPos
    
  • Added IGModAudioChannel:GetVolume
    
  • Added IGModAudioChannel:SetTime
    
  • Added IGModAudioChannel:Set3DFadeDistance
    
  • Added IGModAudioChannel:Get3DFadeDistance
    
  • Added IGModAudioChannel:Set3DCone
    
  • Added IGModAudioChannel:Get3DCone
    
  • Added IGModAudioChannel:GetState
    
  • Added IGModAudioChannel:IsLooping
    
  • Added IGModAudioChannel:IsOnline
    
  • Added IGModAudioChannel:Is3D
    
  • Added IGModAudioChannel:GetLength
    
  • Added IGModAudioChannel:GetFileName
    
  • Added IGModAudioChannel:GetSamplingRate
    
  • Added IGModAudioChannel:GetBitsPerSample
    
  • Added IGModAudioChannel:GetLevel
    
  • Added IGModAudioChannel:FFT
    
  • Added IGModAudioChannel:GetPlaybackRate
    
  • Added IGModAudioChannel:SetPlaybackRate
    
  • Added the GMOD_CHANNEL_* and FFT_* enums
    
  • Added sound.GetTable
    
  • Added sound.GetProperties
    
  • Added GM:StartCommand
    
  • Added GM:EntityFireBullets
    
  • Added util.GetSurfacePropName
    
  • Added system.FlashWindow
    
  • VMatrix objects can now be printed to the console
    
  • Added VMatrix support for the following operators: ==, ~=, +, -
    
  • Added VMatrix:ToTable
    
  • Added VMatrix:Set
    
  • Added VMatrix:Identity
    
  • Added VMatrix:IsIdentity
    
  • Added VMatrix:IsRotationMatrix
    
  • Added VMatrix:Invert
    
  • Added VMatrix:GetRight
    
  • Added VMatrix:GetUp
    
  • Added VMatrix:SetForward
    
  • Added VMatrix:SetRight
    
  • Added VMatrix:SetUp
    
  • Added VMatrix:GetField
    
  • Added VMatrix:SetField
    
  • Added VMatrix:SetScale
    
  • Added VMatrix:InvertTR
    
  • Added VMatrix:GetInverse
    
  • Added VMatrix:GetInverseTR
    
  • Added VMatrix:GetForward
    
  • Added Player:GetCurrentViewOffset
    
  • Added Player:SetCurrentViewOffset
    
  • Added Entity:AddFlags
    
  • Added Entity:RemoveFlags
    
  • Added Entity:IsFlagSet
    
  • Added FL_* enums
    
  • Added Player:GetViewPunchAngles
    
  • Added Player:SetViewPunchAngles

Due to character limits, the list below does not include changes contributed by the community.
The full changelog can be found here.

FIXES

• Fixed viewmodel bobbing snapping when jumping or noclipping
  
• Fixed flashlight getting duplicated when receiving a full packet update
  
• Fixed spawnicons not always regenerating at the correct resolution when resized
  
• Fixed lamps projecting backwards!
  
• Fixed gamemode name reported by Steam not being updated after a changelevel
  
• Fixed key bindings not working correctly in the main menu
  
• Fixed GMod decals not working when used on props
  
• Fixed debug textures not being precached
  
• Fixed rendering artifacts when some particle effects are rendered in front of the skybox
  
• Fixed nav files remaining open after loading a map
  
• Fixed shell ejection issues on the HL2 pistol and SMG
  
• Fixed viewmodel jittering when overwriting viewmodel position
  
• Fixed viewmodel prediction errors when switching to thirdperson and back
  
• Fixed sound spam with weapon_rpg when no ammo is left
  
• Fixed jigglebones occasionally snapping into impossible positions when rapidly moving
  
• Fixed keyframe_rope ignoring attachment points
  
• Fixed combine balls not colliding with players
  
• Fixed env_zoom not working at all
  
• Fixed metrocops holding the stunstick going into a T-pose when attacked
  
• Fixed metrocops not turning their stunstick on before attacking
  
• Fixed NPCs not receiving the appropriate amount of damage from HL2 weapons

IMPROVEMENTS

• Improved mounting system
  
• sv_kickerrornum now defaults to 0 and its value is now saved to the config file
  
• sv_allowcslua is now saved to the config file
  
• Clientside Lua is now always allowed in singleplayer
  
• Improved some spawn icons
  
• TextEntry panels no longer filter '\t' characters
  
• Restored old damage force behaviour
  
• Singleplayer jump boost from HL2 is now implemented in Lua as a sandbox feature

ADDITIONS

• Added clientside convar cl_steamoverlay_pos

LUA SCRIPTING

• Fixes
  
  • Fixed render.SetStencilWriteMask setting the test mask instead of the write mask
    
  • Fixed CLuaEmitter:Finish not freeing the emitter
    
  • Fixed util.TableToJSON not encoding floating point values with enough accuracy
    
  • Fixed Player:ScreenFade not taking color alpha into account
    
  • Fixed GM:GravGunPickupAllowed not preventing the gravity gun from trying to pick up forbidden entities
    
  • Fixed GM:GravGunPunt not being called clientside when holding an object
    
  • Fixed CSoundPatch:Stop not actually stopping the sound when the game is paused
    
  • Fixed memory leak when calling timer.Create on an already existing timer
    
  • Fixed surface.GetTextSize ignoring '&'
    
  • Fixed the gravity gun and crowbar being removed when dropped using Player:DropWeapon
    
  • Partially fixed functions from the render and surface library not writing alpha when drawing on a render target
    
  • Fixed Entity:GibBreakClient not taking skin number into account
    
  • Fixed Entity:MapCreationID returning different values after a map cleanup
    
  • Fixed NEXTBOT:Use not being called
    
  • Fixed panels not feeding mousewheel events to their parent if the PANEL:OnMouseWheeled hook is defined
    
  • Fixed long-term performance issues with Entity:Remove
    
  • Fixed Entity:EnableMatrix not propagating matrix transform to child bones
    
  • Fixed an exploit with require, Player:ConCommand and game.ConsoleCommand
    
  • Fixed nan and +/-infinity returning a non null terminated string when converted into a string
    
  • Fixed Pre/PostDrawOpaqueRenderables receiving incorrect arguments
    
  • Fixed file functions not working with file names containing certain special characters
    
  • Fixed VMatrix:SetAnglesnot preserving translation and scale
    
  • Fixed surface.CreateFont disconnecting clients when an invalid table is passed
• Improvements
  
  • HTTP requests now accept a "headers" table
    
  • game.AddDecal now accepts a string table as its second argument
    
  • Entity:IsValid no longer returns true on entities which have been removed during the current frame
    
  • Player:LagCompensation should now work in any predicted hook
    
  • Changed GM:CalcViewModelView, return a position and an angle to override viewmodel position
    
  • vm_origin and vm_angles fields in table returned from GM:CalcView are now deprecated
    
  • sound.PlayURL second parameter can now contain the “noblock” flag, which disables streaming in blocks
    
  • IGModAudioChannel:Stop now permanently deletes the channel
    
  • IGModAudioChannel:SetPos now takes an orientation vector as an optional second argument
    
  • Improved command blacklisting for Player:ConCommand and game.ConsoleCommand
    
  • sound.Add now accepts a table as its pitch and volume parameters
    
  • Moved Vector:__unm from Lua to C
    
  • Moved Angle:__unm from Lua to C
    
  • Matrix can now take an optional 4x4 table as an argument
    
  • Matrices can now be multiplied by vectors
    
  • Player:ViewPunchReset first argument is now optional (defaults to 0)
    
  • All trace functions from the util library now accept an ‘ignoreworld’ boolean parameter in their trace data
    
  • net.Start now starts an unreliable message if its second argument is true
    
  • Changed Entity:DispatchTraceAttack arguments to (dmginfo, traceres, dir)
• Additions
  
  • Added chat.Open
    
  • Added chat.Close
    
  • Added render.SetLightmapTexture
    
  • Added render.PushRenderTarget
    
  • Added render.PopRenderTarget
    
  • Added GM:EntityEmitSound
    
  • Added NEXTBOT:OnRemove
    
  • Added timer.TimeLeft and timer.RepsLeft
    
  • Added render.OverrideAlphaWriteEnable
    
  • Added render.OverrideColorWriteEnable
    
  • Added render.SetWriteDepthToDestAlpha
    
  • Added a few requested ACT enums
    
  • Added PANEL:OnRemove hook
    
  • Removed PANEL:OnDeletion hook
    
  • Replaced Entity:GetTextures with Entity:GetMaterials
    
  • Added IGModAudioChannel:GetPos
    
  • Added IGModAudioChannel:GetVolume
    
  • Added IGModAudioChannel:SetTime
    
  • Added IGModAudioChannel:Set3DFadeDistance
    
  • Added IGModAudioChannel:Get3DFadeDistance
    
  • Added IGModAudioChannel:Set3DCone
    
  • Added IGModAudioChannel:Get3DCone
    
  • Added IGModAudioChannel:GetState
    
  • Added IGModAudioChannel:IsLooping
    
  • Added IGModAudioChannel:IsOnline
    
  • Added IGModAudioChannel:Is3D
    
  • Added IGModAudioChannel:GetLength
    
  • Added IGModAudioChannel:GetFileName
    
  • Added IGModAudioChannel:GetSamplingRate
    
  • Added IGModAudioChannel:GetBitsPerSample
    
  • Added IGModAudioChannel:GetLevel
    
  • Added IGModAudioChannel:FFT
    
  • Added IGModAudioChannel:GetPlaybackRate
    
  • Added IGModAudioChannel:SetPlaybackRate
    
  • Added the GMOD_CHANNEL_* and FFT_* enums
    
  • Added sound.GetTable
    
  • Added sound.GetProperties
    
  • Added GM:StartCommand
    
  • Added GM:EntityFireBullets
    
  • Added util.GetSurfacePropName
    
  • Added system.FlashWindow
    
  • VMatrix objects can now be printed to the console
    
  • Added VMatrix support for the following operators: ==, ~=, +, -
    
  • Added VMatrix:ToTable
    
  • Added VMatrix:Set
    
  • Added VMatrix:Identity
    
  • Added VMatrix:IsIdentity
    
  • Added VMatrix:IsRotationMatrix
    
  • Added VMatrix:Invert
    
  • Added VMatrix:GetRight
    
  • Added VMatrix:GetUp
    
  • Added VMatrix:SetForward
    
  • Added VMatrix:SetRight
    
  • Added VMatrix:SetUp
    
  • Added VMatrix:GetField
    
  • Added VMatrix:SetField
    
  • Added VMatrix:SetScale
    
  • Added VMatrix:InvertTR
    
  • Added VMatrix:GetInverse
    
  • Added VMatrix:GetInverseTR
    
  • Added VMatrix:GetForward
    
  • Added Player:GetCurrentViewOffset
    
  • Added Player:SetCurrentViewOffset
    
  • Added Entity:AddFlags
    
  • Added Entity:RemoveFlags
    
  • Added Entity:IsFlagSet
    
  • Added FL_* enums
    
  • Added Player:GetViewPunchAngles
    
  • Added Player:SetViewPunchAngles

- Workshop addons can be downloaded when joining a server
- Added resource.AddWorkshop( workshopid )
- Fixed fonts being invisible on resolution change
- Fixed crash when starting map
- Fixed sound.PlayURL not always calling the callback properly
- Banned 1,500 cheaters

If you have been banned for cheating and are sure you didn't cheat - then please email me at garry@garrysmod.com with your 64bit SteamID and I will look into it for you.

- Workshop addons can be downloaded when joining a server
- Added resource.AddWorkshop( workshopid )
- Fixed fonts being invisible on resolution change
- Fixed crash when starting map
- Fixed sound.PlayURL not always calling the callback properly
- Banned 1,500 cheaters

If you have been banned for cheating and are sure you didn't cheat - then please email me at garry@garrysmod.com with your 64bit SteamID and I will look into it for you.

Next week we're switching Garry's Mod over to Steampipe!

You can (and should) read more about what this means here.

@garrynewman

Next week we're switching Garry's Mod over to Steampipe!

You can (and should) read more about what this means here.

@garrynewman