Fixes and Updates

• Fixed cl_autowepswitch setting not being respected after respawning
  
• Fixed "cl_autowepswitch 1" causing the crowbar to be auto-equipped after spawning
  
• Fixed viewdemo command crashing for certain demo files
  
• Security fix to client disconnect handling
  
• Security fixes to console command handling
  
• Security fix to client/server communications
  
• Security fix to model loading
  
• Security fixes to BSP loading
  
• Added "Leave game" menu option when in a single-player game to exit back to the main menu
  
• Setting cl_autowepswitch to 2 will now enable auto weapon switching on pickup of a better weapon except when holding Primary or Seconday attack
  

Note: This was updated with additional changes:

• Security fix to client launching
  
• Security fix to sound file verification
  

• Fixed mods not loading when they use certain GameDLL paths
  
• Fixed some resources not downloading properly through FastDL
  
• Fixed gl_texturemode and gl_ansio not updating properly when enabling/disabling Low video quality mode
  

Fixes and Updates

• Fixed setting monitor refresh rates through -freq when used with -nofbo
  
• Fixed unnecessary texture rescaling with NPOT textures
  
• Fixed slist command, will now show servers on the local network
  
• Fixed erroneous return in SV_ClipToLinks (HL #1685)
  
• Fixed inability to reload a partially empty weapon after reloading a save game
  
• Fixed MP5 spread factor, multiplayer factor was being used for single player and single player for multiplayer
  
• Fixed progress bar for individual files in resource download always showing at 100%
  
• Added auto-saving of several cvars (HL #2237)
  
• Fixed missing localizations in spectator UI
  
• Fixed NPC turn rate when running at >60FPS
  
• Reordered columns in server browser to prevent game descriptions from being used to fake server player count
  
• Fixed sv_cheats from being settable by players in a multiplayer game (sv_cheats is controllable by the server)
  
• Added cl_autowepswitch cvar with values 0/1 to disable/enable auto weapon switching when a new weapon is picked up
  
• Fix various weapon animation/sound issues
  
• Security fixes to console commands
  
• Security fixes to resource loading
  
• Security fixes to saving/loading
  

• Added privilege checking to command execution. Commands originating outside of the client are now only able to execute commands that are considered to be safe. Commands such as 'connect', 'bind', 'quit' and certain cvars such as 'cl_filterstuffcmd' are now only executable by trusted sources.
  
• Setting 'cl_filterstuffcmd' to a value greater than zero (e.g. 'cl_filterstuffcmd 1') will set a number of commands that are potentially abusable, such as 'say', 'fps_max', and 'setinfo', to also be only executable by privileged sources.
  

• Fixed client incorrectly blocking download of custom sprays
  

• All custom resources downloaded from a server now have their file name's checked for safety before being allowed to download
  
• Invalid file extensions are now prevented in several commands
  
• Dynamic libraries are no longer searched for in custom resource directories
  
• Added additional file extensions to custom resource blocked extensions list
  
• Fixed buffer overflow in message delta parsing
  
• Fixed RCE in weapon message handling
  
• Fixed RCE in model loading
  
• Fixed RCE in saved game loading
  
• Fixed buffer overflows in TGA and BMP loading
  
• Fixed buffer overflow in demo playback
  
• Fixed buffer overflows in sequence file loading
  
• Fixed buffer overflows in model name loading
  
• Fixed buffer overflow in music playlist loading
  
• Fixed buffer overflow in detail texture loading
  
• Fixed buffer overflow in console map listing
  
• Fixed command chaining in cvar's that specified config files to be passed to the 'exec' command
  

• Fixed bug in skybox image loading
  
• Fixed bug in demo command processing
  
• Prevent certain path characters from being used in commands
  
• Enforce certain extensions be used for files specified in some commands
  

• Rate limit hltv commands to prevent connection issues
  

• Fixed crash when entering certain malformed strings into the game console. Thanks to Marshal Webb from BackConnect, Inc for reporting this.
  
• Fixed crash when loading a specially crafted malformed BSP file. Thanks to Grant Hernandez (@Digital_Cold) for reporting this.
  
• Fixed malformed SAV files allowing arbitrary files to be written into the game folder. Thanks to Vsevolod Saj for reporting this.
  
• Fixed a crash when quickly changing weapons that are consumable. Thanks to Sam Vanheer for reporting this.
  
• Fixed crash when setting custom decals
  

• Fixed crash when loading maps with malformed entity data
  

• Fixed mouse not working correctly in VGUI1 based UI's, mods and TFC make use of this
  

• Added support for a crcclientdll key in liblist.gam to turn client.dll crc checking back on, useful for 3rd party mods
  
• Make sure the Close button has keyboard focus when you see the disconnection dialog
  
• Made the play command obey speak_enabled cvar
  
• Door movement sound fixes, make sure you stop playing the moving sound if you get disrupted
  
• Fixed hang when loading maps with corrupt entity data
  
• Fixed being unable to load map resource files if they started with the UTF-8 BOM
  
• Fixed audio artifact in sound track Nuclear Mission Jam
  
• Fixed hud_centerid to apply correctly in Half-Life 1 games
  
• Fixed crash if you hit retry while in control of a func_tank
  
• Fixed sprays not loading from the correct path causing them not to update
  
• Fixed a crash if you started a local multiplayer game, disconnected and then loaded a save game