ConsoleSystem.Run is now restricted

[garrynewman]

I posted some updates yesterday that should make ConsoleSystem.Run restricted, meaning you can't run unbindall or quit on clients anymore.

Please let me know if you run into any problems with it, or there are still ways to run commands that I left open.

[nywek]

Are there specific reasons why bot_add, bot_kick or kick <name> are blocked serverside?
It still works when executed on the host client.

[garrynewman]

Every convar that is created by the engine is blocked. The fact that you can call it from client is an exploit, I'll fix that.

[nywek]

So adding/kicking bots will no longer be possible by using the ConsoleSystem?
Will there be an API that allows this functionality or are "bot clients" just something we should not be using?

[FlorianLeChat]

I agree with @Fear837. It would be wrong to block ALL commands coming from the engine, for example the commands for bots as mentioned above (but not only these ones), there is no risk on serverside if it's intended by a script.

[garrynewman]

Yeah we can add APIs to do this stuff rather than having you run console commands. Just request.