Restrict maximum length of messages to 50.000 characters and disable sending functions or table references over the wire. Restrict types of channel variable to string, number or boolean.

The missing length restriction made DoS-like attacks possible by overflowing memory using string concatenation. Thanks to gamemanj for disclosing this issue.

There is no more need for that since VoxelManip caching makes sure we
always get an answer to get_node_force.

Duplicating that small piece of code seems like a better idea than
putting the undo-forceloading code back into util.lua. This way, it is
easier to remember to remove that unneccesary code after a couple of
months / years, when people have transitioned. This also means we can
make changes to the code in util.lua without breaking old code.

The change that required this compatibility layer happened in
2014, so other mods have had a lot of time to update.

Instead of seperately looking for onstate receptors along equipotential
sections of the circuit before turning off, do that while already
modifying the VoxelManip. In case an onstate receptor is found, discard
the VoxelManip cache, otherwise commit it after turnoff is completed.

It is no longer possible for get_node_force to return nil if the target
location does, in fact, exist, because a VM will always be able to load
it (whereas a forceload might not, due to exhaustion of forceload
resources). So it is no longer necessary to handle get_node_force
returning nil by deferring processing.

VoxelManipulator-based transactions are used to hopefully speed up
scanning and replacing of networks of conductors when receptors start or
stop driving signals into them.

Rather than calling out through the Lua-to-C API for each node that
needs to be read or written, a group of map reads (and optionally
writes) can be grouped into a transaction. Access to map data within the
transaction is provided at high speed by means of VoxelManipulators.
Once the reads and writes are finished, the transaction can be committed
or aborted.

A VoxelManipulator, when asked to read a mapblock, in addition to making
that mapblock available to the caller, also pulls it into the server’s
map cache, thus making get_node calls in the immediate future succeed.

This has the dual advantages that not every mapblock containing a
Mesecons circuit need remain loaded at all times (rather mapblocks can
be loaded on demand as signals are sent), and that the server need not
bother running ABMs and ticking entities within those mapblocks that are
loaded due to Mesecons signalling.

The update_autoconnect function had to be abstracted away from the
default wires, any kind of wire can now register autoconnect hooks,
which should make having multiple different wire types much easier.

mesecons_mvps, mesecons_receiver and mesecons_random made use of
update_autoconnect, their code was also adapted. This also fixes a
receiver bug: If a receiver was placed with a onstate receptor next
to it (but not the wall lever / button that caused the receiver to
appear) the receiver didn't turn on in the past.

Also move documentation for mesecon wire into mesecons_wire.

Remove an obsolete comment.

turnon / turnoff were calling activate / deactivate on nodes even though
their rules didn't link

Fixes #278, thanks to @darkfeels

Thanks to @Hawk777 for reporting this problem

Before that, command block would crash the server if activated when no
players are online

protection is ignored with protection_bypass_priv

Fixed missing capital letter in "ghoststone"

The files are still available for download in a GitHub release

Closes #265

Escape command block commands for formspec

Disabling LuaJIT for user code enables normal working of debug.sethook() even for loops. The drawback is that that code will run more slowly.

The fourth parameter of string.find indicates whether the second parameter should be interpreted literally (true) or as a pattern (false). Allowing patterns enables DoS attacks, but it's possible to
allow literal matching with little effort, by disallowing the function only if the fourth parameter (plain mode) is not `true`.

fixes #255

prohibited, remove pcall and xpcall, fix global lookup of "jit"
variable, correct error locations

Thanks to @ShadowNinja and @gamemanj for fixing this in #241

Please use the screwdriver if you want to rotate trapdoors.
This reverts commit 417a136c.

and remove debug output