Closed TomLewis closed 5 months ago
Looking at the code, I can see why it's broken:
!commandSender.hasPermission("movecraft.commands") && !commandSender.hasPermission("movecraft.commands.craftreport")
Commands | Craftreport | Rejected |
---|---|---|
True | True | False |
True | False | False |
False | True | False |
False | False | True |
Rather than an AND, it should be an OR.
Describe the bug I have disabled
movecraft.commands.craftreport
at all ranks other than staff, today I found out anyone can use it, so I did a/lp verbose
to see how they somehow got perms, and it only shows up formovecraft.commands
when they run the command, which they have access to, but it should be checking formovecraft.commands.craftreport
so I checked the code, and it checks properly, so I have no idea how its being bypassed https://github.com/APDevTeam/Movecraft/blob/main/modules/Movecraft/src/main/java/net/countercraft/movecraft/commands/CraftReportCommand.java#L25
To Reproduce Steps to reproduce the behavior:
movecraft.commands.craftreport
Expected behavior To not use the command when you dont have permission
Versions (please complete the following information):