9 files changed, 62 insertions, 16 deletions

diff --git a/src/script/cpp_api/s_base.cpp b/src/script/cpp_api/s_base.cpp
index a8ed902dd..caa335d76 100644
--- a/src/script/cpp_api/s_base.cpp
+++ b/src/script/cpp_api/s_base.cpp
@@ -232,6 +232,13 @@ void ScriptApiBase::loadModFromMemory(const std::string &mod_name)
 void ScriptApiBase::runCallbacksRaw(int nargs,
 		RunCallbacksMode mode, const char *fxn)
 {
+#ifndef SERVER
+	// Hard fail for bad guarded callbacks
+	// Only run callbacks when the scripting enviroment is loaded
+	FATAL_ERROR_IF(m_type == ScriptingType::Client &&
+			!getClient()->modsLoaded(), fxn);
+#endif
+
 #ifdef SCRIPTAPI_LOCK_DEBUG
 	assert(m_lock_recursion_count > 0);
 #endif
@@ -404,6 +411,10 @@ void ScriptApiBase::pushPlayerHPChangeReason(lua_State *L, const PlayerHPChangeR
 		objectrefGetOrCreate(L, reason.object);
 		lua_setfield(L, -2, "object");
 	}
+	if (!reason.node.empty()) {
+		lua_pushstring(L, reason.node.c_str());
+		lua_setfield(L, -2, "node");
+	}
 }
 
 Server* ScriptApiBase::getServer()
diff --git a/src/script/cpp_api/s_entity.cpp b/src/script/cpp_api/s_entity.cpp
index 8af9f9bf6..26c7e8cd4 100644
--- a/src/script/cpp_api/s_entity.cpp
+++ b/src/script/cpp_api/s_entity.cpp
@@ -157,7 +157,7 @@ std::string ScriptApiEntity::luaentity_GetStaticdata(u16 id)
 }
 
 void ScriptApiEntity::luaentity_GetProperties(u16 id,
-		ObjectProperties *prop)
+		ServerActiveObject *self, ObjectProperties *prop)
 {
 	SCRIPTAPI_PRECHECKHEADER
 
@@ -170,11 +170,11 @@ void ScriptApiEntity::luaentity_GetProperties(u16 id,
 	prop->hp_max = 10;
 
 	// Deprecated: read object properties directly
-	read_object_properties(L, -1, prop, getServer()->idef());
+	read_object_properties(L, -1, self, prop, getServer()->idef());
 
 	// Read initial_properties
 	lua_getfield(L, -1, "initial_properties");
-	read_object_properties(L, -1, prop, getServer()->idef());
+	read_object_properties(L, -1, self, prop, getServer()->idef());
 	lua_pop(L, 1);
 }
 
diff --git a/src/script/cpp_api/s_entity.h b/src/script/cpp_api/s_entity.h
index 966c2745e..cc08c46e8 100644
--- a/src/script/cpp_api/s_entity.h
+++ b/src/script/cpp_api/s_entity.h
@@ -35,7 +35,7 @@ public:
 	void luaentity_Remove(u16 id);
 	std::string luaentity_GetStaticdata(u16 id);
 	void luaentity_GetProperties(u16 id,
-			ObjectProperties *prop);
+			ServerActiveObject *self, ObjectProperties *prop);
 	void luaentity_Step(u16 id, float dtime);
 	bool luaentity_Punch(u16 id,
 			ServerActiveObject *puncher, float time_from_last_punch,
diff --git a/src/script/cpp_api/s_env.cpp b/src/script/cpp_api/s_env.cpp
index f8cef98b7..ab3b5fe46 100644
--- a/src/script/cpp_api/s_env.cpp
+++ b/src/script/cpp_api/s_env.cpp
@@ -151,6 +151,10 @@ void ScriptApiEnv::initializeEnvironment(ServerEnvironment *env)
 		bool simple_catch_up = true;
 		getboolfield(L, current_abm, "catch_up", simple_catch_up);
 
+		lua_getfield(L, current_abm, "action");
+		luaL_checktype(L, current_abm + 1, LUA_TFUNCTION);
+		lua_pop(L, 1);
+
 		LuaABM *abm = new LuaABM(L, id, trigger_contents, required_neighbors,
 			trigger_interval, trigger_chance, simple_catch_up);
 
@@ -200,6 +204,10 @@ void ScriptApiEnv::initializeEnvironment(ServerEnvironment *env)
 		bool run_at_every_load = getboolfield_default(L, current_lbm,
 			"run_at_every_load", false);
 
+		lua_getfield(L, current_lbm, "action");
+		luaL_checktype(L, current_lbm + 1, LUA_TFUNCTION);
+		lua_pop(L, 1);
+
 		LuaLBM *lbm = new LuaLBM(L, id, trigger_contents, name,
 			run_at_every_load);
 
diff --git a/src/script/cpp_api/s_node.cpp b/src/script/cpp_api/s_node.cpp
index 719f53a6b..d93a4c3ad 100644
--- a/src/script/cpp_api/s_node.cpp
+++ b/src/script/cpp_api/s_node.cpp
@@ -246,7 +246,7 @@ void ScriptApiNode::node_on_receive_fields(v3s16 p,
 	const NodeDefManager *ndef = getServer()->ndef();
 
 	// If node doesn't exist, we don't know what callback to call
-	MapNode node = getEnv()->getMap().getNodeNoEx(p);
+	MapNode node = getEnv()->getMap().getNode(p);
 	if (node.getContent() == CONTENT_IGNORE)
 		return;
 
diff --git a/src/script/cpp_api/s_nodemeta.cpp b/src/script/cpp_api/s_nodemeta.cpp
index b49bb8170..c081e9fc4 100644
--- a/src/script/cpp_api/s_nodemeta.cpp
+++ b/src/script/cpp_api/s_nodemeta.cpp
@@ -38,7 +38,7 @@ int ScriptApiNodemeta::nodemeta_inventory_AllowMove(
 	const NodeDefManager *ndef = getServer()->ndef();
 
 	// If node doesn't exist, we don't know what callback to call
-	MapNode node = getEnv()->getMap().getNodeNoEx(ma.to_inv.p);
+	MapNode node = getEnv()->getMap().getNode(ma.to_inv.p);
 	if (node.getContent() == CONTENT_IGNORE)
 		return 0;
 
@@ -76,7 +76,7 @@ int ScriptApiNodemeta::nodemeta_inventory_AllowPut(
 	const NodeDefManager *ndef = getServer()->ndef();
 
 	// If node doesn't exist, we don't know what callback to call
-	MapNode node = getEnv()->getMap().getNodeNoEx(ma.to_inv.p);
+	MapNode node = getEnv()->getMap().getNode(ma.to_inv.p);
 	if (node.getContent() == CONTENT_IGNORE)
 		return 0;
 
@@ -112,7 +112,7 @@ int ScriptApiNodemeta::nodemeta_inventory_AllowTake(
 	const NodeDefManager *ndef = getServer()->ndef();
 
 	// If node doesn't exist, we don't know what callback to call
-	MapNode node = getEnv()->getMap().getNodeNoEx(ma.from_inv.p);
+	MapNode node = getEnv()->getMap().getNode(ma.from_inv.p);
 	if (node.getContent() == CONTENT_IGNORE)
 		return 0;
 
@@ -148,7 +148,7 @@ void ScriptApiNodemeta::nodemeta_inventory_OnMove(
 	const NodeDefManager *ndef = getServer()->ndef();
 
 	// If node doesn't exist, we don't know what callback to call
-	MapNode node = getEnv()->getMap().getNodeNoEx(ma.from_inv.p);
+	MapNode node = getEnv()->getMap().getNode(ma.from_inv.p);
 	if (node.getContent() == CONTENT_IGNORE)
 		return;
 
@@ -181,7 +181,7 @@ void ScriptApiNodemeta::nodemeta_inventory_OnPut(
 	const NodeDefManager *ndef = getServer()->ndef();
 
 	// If node doesn't exist, we don't know what callback to call
-	MapNode node = getEnv()->getMap().getNodeNoEx(ma.to_inv.p);
+	MapNode node = getEnv()->getMap().getNode(ma.to_inv.p);
 	if (node.getContent() == CONTENT_IGNORE)
 		return;
 
@@ -212,7 +212,7 @@ void ScriptApiNodemeta::nodemeta_inventory_OnTake(
 	const NodeDefManager *ndef = getServer()->ndef();
 
 	// If node doesn't exist, we don't know what callback to call
-	MapNode node = getEnv()->getMap().getNodeNoEx(ma.from_inv.p);
+	MapNode node = getEnv()->getMap().getNode(ma.from_inv.p);
 	if (node.getContent() == CONTENT_IGNORE)
 		return;
 
diff --git a/src/script/cpp_api/s_security.cpp b/src/script/cpp_api/s_security.cpp
index e9067a54c..b90b3aa2c 100644
--- a/src/script/cpp_api/s_security.cpp
+++ b/src/script/cpp_api/s_security.cpp
@@ -113,7 +113,6 @@ void ScriptApiSecurity::initializeSecurity()
 		"setupvalue",
 		"setmetatable",
 		"upvalueid",
-		"upvaluejoin",
 		"sethook",
 		"debug",
 		"setlocal",
@@ -244,6 +243,7 @@ void ScriptApiSecurity::initializeSecurityClient()
 		"rawset",
 		"select",
 		"setfenv",
+		// getmetatable can be used to escape the sandbox
 		"setmetatable",
 		"tonumber",
 		"tostring",
@@ -265,6 +265,7 @@ void ScriptApiSecurity::initializeSecurityClient()
 	};
 	static const char *debug_whitelist[] = {
 		"getinfo",
+		"traceback"
 	};
 
 #if USE_LUAJIT
diff --git a/src/script/cpp_api/s_server.cpp b/src/script/cpp_api/s_server.cpp
index 3b461a2a3..1ce2f9d45 100644
--- a/src/script/cpp_api/s_server.cpp
+++ b/src/script/cpp_api/s_server.cpp
@@ -168,3 +168,25 @@ void ScriptApiServer::on_shutdown()
 	runCallbacks(0, RUN_CALLBACKS_MODE_FIRST);
 }
 
+std::string ScriptApiServer::formatChatMessage(const std::string &name,
+	const std::string &message)
+{
+	SCRIPTAPI_PRECHECKHEADER
+
+	// Push function onto stack
+	lua_getglobal(L, "core");
+	lua_getfield(L, -1, "format_chat_message");
+
+	// Push arguments onto stack
+	lua_pushstring(L, name.c_str());
+	lua_pushstring(L, message.c_str());
+
+	// Actually call the function
+	lua_call(L, 2, 1);
+
+	// Fetch return value
+	std::string ret = lua_tostring(L, -1);
+	lua_pop(L, 1);
+
+	return ret;
+}
diff --git a/src/script/cpp_api/s_server.h b/src/script/cpp_api/s_server.h
index 769939d3f..a4cede84d 100644
--- a/src/script/cpp_api/s_server.h
+++ b/src/script/cpp_api/s_server.h
@@ -36,14 +36,18 @@ public:
 	// Calls on_shutdown handlers
 	void on_shutdown();
 
+	// Calls core.format_chat_message
+	std::string formatChatMessage(const std::string &name,
+		const std::string &message);
+
 	/* auth */
 	bool getAuth(const std::string &playername,
-			std::string *dst_password,
-			std::set<std::string> *dst_privs);
+		std::string *dst_password,
+		std::set<std::string> *dst_privs);
 	void createAuth(const std::string &playername,
-			const std::string &password);
+		const std::string &password);
 	bool setPassword(const std::string &playername,
-			const std::string &password);
+		const std::string &password);
 private:
 	void getAuthHandler();
 	void readPrivileges(int index, std::set<std::string> &result);