
Found this last night: http://www.hackforums.net/showthread.php?tid=3856697

Already fixed it on the DM
-------------------------------------------------------


As some of you may know already, there is a exploit to spawn blacklisted props on DarkRP servers, it can be done easily and without any scripts, by simply changing the model's path, FPP won't pick it up as a blacklisted prop.

This is a black listed prop:
models/props_c17/oildrum001_explosive.mdl

replace it with:

models/props_c17/../props_c17/oildrum001_explosive.mdl

and you should be able to spawn it.

type "gm_spawn models/props_c17/../props_c17/oildrum001_explosive.mdl" in the conosle and you will spawn a explosive barrel on a server even if it has a blacklist.

I hope that a bunch of kids won't find this out >.>

For all you server owners:

    Quote:function SpawnedProp(ply, model, ent)

    if string.match(model, ".+%/../") and IsValid(ent) then
    ent:Remove()
    ply:PrintMessage( HUD_PRINTTALK, '[FPP] blacklist bypass detected' )
    end

    end
    hook.Add("PlayerSpawnedProp", "playerSpawnedProp", SpawnedProp)

------------------------------------------------------------
gm_spawn models\props_phx\..\props_phx\torpedo.mdl 
just bypassed darkrp's patch, your patch and everyone else's patch

------------------------------------------------------------
I don't think it bypassed mine, here's the code:

HAC.BadPropPaths = {
	"../",
	"\\",
}


function HAC.PlayerSpawnObject(ply,Args1,Args2)
	if not IsValid(ply) or not Args1 then return false end
	Args2 = Args2 or ""
	
	local Found,IDX,What = Args1:InTable(HAC.BadPropPaths)
	if Found then
		ply:LogOnly( Format("PlayerSpawnObject[[%s]],[[%s]] (%s)", Args1, Args2, What) )
		
		//Spawn fruit, messy way, fixme!
		ply:ConCommand("gm_spawn "..table.Random(HAC.SERVER.CrapProps) )
		
		//Bit of a hold-up on this end!
		local Snd = table.Random(HAC.SERVER.CrapSounds)
		ply:EmitSound(Snd)
		return false
	end
end
hook.Add("PlayerSpawnObject", "HAC.PlayerSpawnObject", HAC.PlayerSpawnObject)

----------------------------------------------------
gm_spawn models\/props_phx..\/props_phx/torpedo.mdl
what about this 
----------------------------------------------------

I'll check it soon, it should find the backslash "\" and block it. It only allows forwardslash

----------------------------------------------------
so gm_spawn models\props_phx\prop.mdl would not be allowed?
----------------------------------------------------

Correct, it allows ONLY / in the model path, as the Q menu only uses /

\ and ..\ are blocked

----------------------------------------------------
Blocks it fine:

] gm_spawn models\/props_phx..\/props_phx/torpedo.mdl

PlayerSpawnObject("models\/props_phx..\/props_phx/torpedo.mdl")




myg0t is going to be making a c++ p2c for gmod
