search

APDevTeam / Movecraft

The original movement plugin for Paper. Reloaded. Again.
GNU General Public License v3.0
122 stars 74 forks source link

movecraft.commands.craftreport ignored only listens to movecraft.commands #623

Closed TomLewis closed 5 months ago

TomLewis commented 6 months ago

Describe the bug I have disabled movecraft.commands.craftreport at all ranks other than staff, today I found out anyone can use it, so I did a /lp verbose to see how they somehow got perms, and it only shows up for movecraft.commands when they run the command, which they have access to, but it should be checking for movecraft.commands.craftreport

so I checked the code, and it checks properly, so I have no idea how its being bypassed https://github.com/APDevTeam/Movecraft/blob/main/modules/Movecraft/src/main/java/net/countercraft/movecraft/commands/CraftReportCommand.java#L25

To Reproduce Steps to reproduce the behavior:

  1. Deny movecraft.commands.craftreport
  2. Use the command

Expected behavior To not use the command when you dont have permission

Versions (please complete the following information):

TylerS1066 commented 5 months ago

Looking at the code, I can see why it's broken:

!commandSender.hasPermission("movecraft.commands") && !commandSender.hasPermission("movecraft.commands.craftreport")
Commands Craftreport Rejected
True True False
True False False
False True False
False False True

Rather than an AND, it should be an OR.