I'm not sure if he completely replaces the server's client scripts or just injects his own alongside them.
If you DO have client scripts on your server, I don't know a complete script-side fix, but the only thing I can recommend until a patch is released, is to replace the CallServerFunc() function with something else. Make it a secret word, and compile your client scripts so its not obvious. You will need to replace every CallServerFunc() with the new function.
Here's how you do it. Replace SecretFunction with your OWN word:
SecretFunction <- CallServerFunc;
CallServerFunc <- null;
Then, to call a server function, just use the new function.
This is not a completely secure fix. If the hacker figures it out, he could still obtain your secret function name.
For those who do NOT have client scripts, he can still inject his own. There is a scriptside fix for these people that I know will work since I got to test it with s19 a while back. The fix is simple, but you cannot use any clientside function or access anything clientside via any script (or vice versa) once this is applied.
Here is the fix:
function onPlayerConnect( player )
{
CallClientFunc( player , null , "setroottable" , null );
}
