MrFrost Server Essentials Arma Reforger Mod

MrFrost Server Essentials
Changelog, versions 1.0.4 to 1.1.0

github.com/MrFrostDev/MrFrost-ServerEssentials


VERSION 1.1.0   (2026-08-01)

BEFORE YOU UPDATE

  ! cooldownSeconds is held between 0 and 3600. Above 2,147,483 it used to
    wrap to a negative number and remove the cooldown entirely - the setting
    that asks for the strictest throttle gave the weakest. If your
    report.json sets it above 3600, it is now 3600. The server says so on
    its console when it caps.

  ! A server that shipped an infomenu.json without categories gave its
    players a Discord button pointing at the addon author's server, and no
    value it could write would stop it - an absent key and "" arrive
    identical, so the empty string the documentation offers as "draws no
    button" was the same input as saying nothing. The footer links are no
    longer inherited: a server that ships a file owns its own footer. If you
    rely on that inheritance, write discordUrl, websiteUrl and customUrl
    into your file.

  ! A strings override with no text blanked the widget it named instead of
    being ignored. If you used {"key": "...", "text": ""} deliberately to
    hide a label, that entry is now refused and the built-in wording comes
    back.

FIXED

  - The report menu could not be used with a controller. Nothing held focus
    when it opened, so no button responded until a mouse moved the cursor
    onto one, and the info menu's page text could not be scrolled at all.
    Both menus now take focus on open and answer the stick.
  - One capital letter in a server file could replace the whole menu with
    the addon's demo content, silently. "enabled": True, a misspelt fasle, a
    number written .5, and a Windows path in a text value all passed the
    file check and then failed the parse - which cannot report failure, so
    every setting fell back to its default while the server console said the
    file had loaded. Those files are now rejected, by name, on the server
    console.
  - A file saved from Notepad or Out-File was rejected outright: both write
    a byte order mark, and the message sent the owner looking for a missing
    comma in a file whose punctuation was perfect. The mark is dropped.
  - A description at the documented maximum of 8191 could be cut through the
    middle of a character, which Discord rejects, losing that report.
  - A repeated content packet after a channel had finished put that channel
    back in the pending set, where nothing would ever complete it. The
    welcome menu then never opened again for the rest of the session.
  - The keys that open the two menus fired everywhere, including into an
    open menu and into the description box. Rebind Report to a letter and
    the first time you typed it the form closed and took the report with it;
    F11 over an open report menu buried it under the info menu. The keys now
    stay out of a menu they did not open, and switch between the two rather
    than stacking them.
  - The welcome menu could open a second time, over gameplay, up to two and
    a half minutes after a player had already read it and closed it
    themselves.
  - A menu whose content failed to load had no way out - the back prompt is
    built with the footer, and the footer came second.
  - logFile set to a reserved Windows device name (NUL, CON, COM1, ...) was
    accepted, and every report written to it was discarded while the console
    reported each one as written.
  - Warnings about settings that cannot change while the server runs were
    printed once per report rather than once.
  - The same merge discarded a discordLabel, websiteLabel, customLabel or
    menuIconImageset written without its paired key.
  - The menu opened from the pause screen before the server's content had
    arrived showed the addon's placeholder pages - and counted as the
    welcome, so the server's real one never opened. It no longer counts
    until the content is in, and a mission restart offers it again.
  - The title and the pause-menu entry read "Server Info" in English in all
    thirteen languages on a default install, because the shipped value won
    against the translated fallback. Both ship empty now and read "Info" in
    the player's own language; a server that sets either still gets exactly
    what it wrote.
  - The Discord sender stalled under a steady stream of reports: every new
    report pushed the next send further out, so one report went and the rest
    queued.

SECURITY

  - With verboseLogging on, a modified client could write to the server log
    without bound: two paths logged a rejection per packet with no limit
    and, in one case, whatever text the client chose to put in it.
  - Control characters a player typed reached reports.log unfiltered, so a
    reporter could erase the lines above their own in a terminal. Discord's
    copy has always stripped them, so the two records of one report
    disagreed.

CHANGED

  - A mistyped accentColor is now reported on the server console rather than
    in every player's log, where the owner who wrote the file could not see
    it.


VERSION 1.0.7   (2026-08-01)

BEFORE YOU UPDATE

  ! report.nobody_nearby now means the report was filed and nobody was
    named. It used to mean the report was refused. If you replaced that
    string through a strings block, re-read it before upgrading - your
    wording will still win over the built-in one, and it now describes the
    opposite of what happened.

FIXED

  - With revealNobodyNearby on, a nearby report with nobody in range was
    thrown away rather than filed. The player was told something true about
    their surroundings and nothing about their report, and left able to send
    it again and lose it again. The report goes either way now.
  - Fourteen fields and a method on the modded player controller carried no
    prefix. A second mod picking one of those names collides in the same
    chain, and for the method that is a compile error - which takes down
    every mod on the server.
  - nearbyRadius at zero or below now falls back to 300, the way
    maxDescription falls back to 1000. No shipped configuration could reach
    that state; the guard closes the path rather than a symptom.
  - Several translations said the wrong thing: German called a bug report an
    error message, Portuguese and Chinese used the verb for denouncing a
    person on the bug tab specifically, and Spanish said players at the
    radius rather than within it. Four more drifted from the word their own
    language uses everywhere else, and the German player-picker label was
    half again as long as any sibling in a slot that cannot grow.
  - The website button was labelled in English for every player. The example
    infomenu.json no longer fills that label in, so copying it as documented
    leaves the translation in place.


VERSION 1.0.6   (2026-08-01)

FIXED

  - A server whose report.json could not be repacked without its webhook
    block said so once, in the middle of the first player's join, and every
    client after that quietly used the bundled settings. The client-safe
    form is now built when the server starts, where an owner is watching.
  - "categories": null, "strings": null or "entries": null in infomenu.json
    passed every check and then broke - on the server it cost the rest of
    the startup read, on clients it cost the content of a channel already
    marked as delivered.
  - A server file too large to send was transmitted in full to every joining
    player and discarded in total on arrival, with nothing said on either
    machine. The limit is now checked before sending, and named.
  - A report against a player picked from the list could name whoever
    inherited that player's id if they left while the report was being
    written. The pick now carries the name the reporter was looking at, and
    the server refuses it when the two no longer agree.
  - Content arriving over the network was installed without being checked,
    so a payload a client could not read came back as the addon's defaults
    while the console said the server's settings were in use. Both features
    check it now, the same way the server checks its own files.
  - A report that reached neither the log file nor Discord was reported to
    the owner as "neither is configured", contradicting the line above it
    that had just named the real reason - a full disk, or a queue that was
    full.


VERSION 1.0.5   (2026-07-31)

FIXED

  - Each footer link listened for its key twice, so one press opened the
    browser twice - and the second listener ran outside every guard the
    prompt applies, so with the report menu open on top of the info menu,
    typing a d into a description opened Discord.
  - Nothing bounded how many rows a server could have a client build. Each
    row is fifteen widgets, created up front, in a menu that opens by itself
    on join. A page of text far past any rule set is now left out rather
    than cut, because a cut cannot leave markup whole.
  - The accent colour never reached the line under the header, which kept
    the built-in gold whatever a server set.
  - A menu whose categories were all switched off still had a pause entry
    and a key, and opened empty - unless it carries footer links, which live
    nowhere else and would otherwise become unreachable.
  - A page with nothing on it said "this info menu has no entries yet",
    beside a full tree of categories. It has its own wording now.
  - Hosting your own game after playing on a server kept that server's menu,
    wording and log setting.
  - Whether to show the welcome menu was decided before the server's own
    content arrived, so a server that had switched it off could still be
    overridden.
  - A second connection in the same session was not recognised as a fresh
    start, and the player was never welcomed.
  - String overrides written into infomenu.json were honoured by every
    player and ignored in the server's own Discord embed.
  - "No other players" was written into the dropdown but never selected, so
    the closed box showed nothing at all.
  - The welcome menu gave up after about a minute of waiting, which the
    server's own content can outlast when several players join at once. It
    waits about two and a half minutes now.
  - The row icon column was two pixels narrower than the icon it holds.
  - The player dropdown was filled without being emptied first, so anything
    the layout shipped with would have shifted every index behind it.
  - The transfer confirmation could never appear in a client log, because
    verbose logging is a setting that arrives with the transfer it was meant
    to confirm. The server now says when it has sent everything, which is
    the only side that knows.
  - maxDescription of zero disabled the length cut on the addon config path,
    which the JSON path already guarded against.


VERSION 1.0.4   (2026-07-31)

ADDED

  - report.failed, told to a player whose report reached neither the log
    file nor Discord. Until now that was reported as sent.

CHANGED

  - A footer link is only offered if it is an https:// address. The URL
    comes from the server and is never shown, so a button labelled Discord
    could lead anywhere. A link that does not qualify draws no button, and
    the server names the key on its own console when it reads the file.
  - A webhookUrl that is not an https:// address is dropped when the file is
    read rather than when the first report is already on its way.
  - The Discord queue is bounded. Past the cap the newest report is dropped,
    not the oldest, because the first reports of an incident are the ones a
    moderator wants.

FIXED

  - Damage was watched on everything the world spawned, not only on players.
    That allocated per-entity data vanilla deliberately avoids, and with it
    present every bullet, fragment and damage tick on the server ran a
    script dispatch that could only ever be discarded. On a Conflict server
    with a few hundred AI alive, hundreds of them a second.
  - The report kind was taken from the client and only two values were
    tested for. A third slipped past both permission checks and arrived as a
    bug report on a server that had switched bug reports off.
  - Only accepted reports were rate limited. Every rejected one - no
    description, no target, nobody nearby, feature switched off - was free,
    so a modified client could hold the server in a loop of player sweeps at
    packet rate.
  - A client could ask for the server's files repeatedly. The guard only
    stopped overlapping transfers, so waiting for one to finish and asking
    again rebuilt everything, without limit.
  - A report could be lost while the player was told it had been sent.
  - Server files were sent with their indentation, which on a pretty-printed
    config is easily a tenth of every byte sent to every player who joins.
  - The packet count for a transfer depended on how the server owner had
    formatted their JSON, not on how large it was.
  - The client-safe form of each file was rebuilt for every joining player,
    though it is the same for all of them.
  - Transfer pacing was per player, so sixty-four clients joining after a
    restart ran sixty-four independent senders at once - the burst the
    pacing exists to prevent.
  - A control character in a description made Discord reject the whole
    message, with an error naming the webhook settings rather than the
    cause.
  - Embed titles, footers and the webhook username went to Discord
    unbounded.
  - maxDescription set to zero disabled the length cut entirely instead of
    meaning what it says.
  - Reports left the Discord queue out of order when several arrived close
    together.
  - A second answer could overwrite the first, telling a player their filed
    report had bounced.
  - The info menu built every row with two colour animations that ramped
    from transparent to transparent, each costing a scan of a global
    animation list.

SECURITY

  - A malicious client could make the server allocate an array sized by a
    number it chose, and a malicious server could do the same to every
    client that joined it. Both are bounded now.