Execute lua from var

[mistr88]

Yes I agree its going off topic.
But what you probably don’t understand is that the command line is for developing and practically team create only, so when we will talk about hacking accounts, hacker can just edit it in team create, and also we all have external contact and also secondary profiles (also in friends so message able) so I can just demote hacked player from the rank he have to new, also when we talk about hacking acounts, the game without updates will die, with console or without console

[Kiansjet]

If you’re looking for advice, its objectively a bad idea to allow arbitrary serverside code execution over the perfectly possible alternative of making predetermined commands and using those like any other admin suite. If you’re hell bent on using loadstring(), use loadstring.

[mistr88]

Ok I think now its best time to just close the topic and don’t answer it, because 1)its going off topic
2)we all losted in it

So I am using predefined commands for lower ranks, but for developers I need to create free command for debugging, because we create it as team and if it is not groupe, the standard server console have only owner.

[Kiansjet]

@mistr88

1)its going off topic
2)we all losted in it

Respectfully:

1. We’ve answered your question multiple times. loadstring().
2. Please clarify

When to and when not to request thread deleting/locking

Preface: There seems to be a lot of confusion on what qualifies a thread for being locked/hidden. Generally this is requested when an OP’s help request is resolved, but this is not the appropriate response. The devforums are a public resource, rather than a private discussion between the OP and the solver. Rather than purely consuming from the forum and giving nothing in return, help requests are meant to provide a resource for everyone – not just the OP – that encounters the problem. What shou…

[mistr88]

I just think answer it when completely new way is here.

[Rhaoke]

And people gaining access to an admin’s account is an edge case that doesn’t really matter, because if they have access to the admin’s account they can most likely run code in the console regardless.

[AxoLib]

Only the owner of the game (or the group the game is under) can run code in the console. Anyone else, including admins, cannot.

[mistr88]

1. Who is admin
   Admins are custom made rank, by roblox, you have player and owner only.
   2.here:

@mistr88

Yes I agree its going off topic.
But what you probably don’t understand is that the command line is for developing and practically team create only, so when we will talk about hacking accounts, hacker can just edit it in team create, and also we all have external contact and also secondary profiles (also in friends so message able) so I can just demote hacked player from the rank he have to new, also when we talk about hacking acounts, the game without updates will die, with console or without console

I say that the team create and player able to use lua commands is 1 and sane group of people

3. It’s going off topic so answer only if you have new idea

[0x_7777]

To summarize everything people have said here so far in regards to the actual question:

You can use loadstring to run arbitrary code server-side. You can also use a Lua bytecode interpreter that is written in Lua, such as GitHub - Rerumu/FiOne: Lua 5.1 bytecode interpreter, in Lua.

This guy understands the risk of having code-execution available through an event. He has already said he has taken the precautions to validate the event user. The point of this forum isn’t to berate someone with your own opinions, just answer the question and move on. (And you really shouldn’t be giving security advice if your advice is based on misconceptions…)

[ForbiddenJ]

It’s simple.

1. Create a RemoteFunction. In this case, I’ll make it game.ReplicatedStorage.DoArbitraryCode

2. Create a server script like this:

   function game.ReplicatedStorage.DoArbitraryCode.OnServerInvoke(player, code)
       -- Error and stop the command if something's wrong.
       assert(player.UserId == 123456789, "You can't use this dummy!")
       assert(typeof(code) == "string", "Code argument must be a string.")
       
       -- Do the thing.
       local f, msg = loadstring(code)
       if f then
           f()
       else
           warn(msg)
       end
   end
   

3. Create a text box in a ScreenGui and name it ScriptBox.

4. Create a LocalScript inside of your ScreenGui.

    DoArbitraryCode = game.ReplicatedStorage.DoArbitraryCode
    ScriptBox = script.Parent.ScriptBox
    
    ScriptBox.FocusLost:Connect(function(enterPressed)
    	if enterPressed then
    		local text = ScriptBox.Text
    		ScriptBox.Text = ""
    		DoArbitraryCode:InvokeServer(text)
    	end
    end)
   

There. You got a simple text box that does Lua. Feel free to do what you want with it.

[mistr88]

At my project i have it on litlebit heigher level (commands stored every single in child of object, and for free comand, predefined command with code in argument(everything out of “” is the code reading as key word and everything in “” is string that is not splited by space)), but really thanks for writing result of this long and confusing topic to 1 post.