2026-06-13T2358Z

Author: Windows81

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 - feat: players can be held in loading screen until RCC first calls `/rfd/data-transfer`
 - feat(config): add `game_setup.ready_delay_sec` to delay clients further
+- build: update dependencies to ensure existence with pre-compiled Python 3.14 wheels for Windows
+
+# 0.66.3
+
+- fix: load homepage in v463 Studio
 
 # 0.66.2
 

Source/game_config/structure.py

@@ -37,6 +37,7 @@ class persistence(allocateable.obj_type):
         # Don't count too much on 2021E.
         # I really recommend that people manually specify which version of Rōblox they want to run.
         roblox_version: util.versions.rōblox = util.versions.rōblox.v463
+
         ready_delay_sec: float = 3
 
     class server_core(allocateable.obj_type):

Source/web_server/_logic.py

@@ -3,6 +3,7 @@
 import enum
 import functools
 import http.server
+import ipaddress
 import json
 import re
 import socket
@@ -192,8 +193,10 @@ def parse_request(self) -> bool:
         self.game_config = self.server.game_config
 
         # Some endpoints should only allow the RCC to do stuff.
+        # Trust the peer socket address, not the user-controlled Host header.
         # TODO: use a proper allow-listing system.
-        self.is_privileged = self.domain == 'localhost'
+        self.is_privileged = ipaddress.ip_address(
+            self.client_address[0]).is_loopback
 
         self.url = f'{self.hostname}{self.path}'
         assert isinstance(self.url, str)