search

AuthMe / AuthMeReloaded

The best authentication plugin for the Bukkit/Spigot API!
https://www.spigotmc.org/resources/authmereloaded.6269/
GNU General Public License v3.0
628 stars 516 forks source link

Moderator chat spying (Compatibility issue with FactionChat plugin) #259

Closed MithrandirCraft closed 8 years ago

MithrandirCraft commented 8 years ago

Steps for reproducing this problem:

1.Install a blank Spigot server 2.Install Authme's latest version, Factions, FactionChat & Mcore plugins. 3.Give faction chat permissions to two player names for moderator chat usage: "factionChat.modChat" 4.Log in with one of those names, and constantly spam the moderator chat. 5.Enter the server with the other name, without logging in.

Issue:

The second player name should not be capable of reading the moderator chat untill he has logged in. Instead he can read everything for 60 seconds and then log back in to keep on reading lol.

Edit: Current situation:

Moderator chat doesn't work at all.

Current authme version: 5.2-SNAPSHOT-b660 Faction chat version: 1.9.12-SNAPSHOT Current Minecraft-Spigot version: 1.8.8

Original Bukkit Ticket (Outdated but commented on): http://dev.bukkit.org/bukkit-plugins/authme-reloaded/tickets/979-moderator-chat-spying-compat-issue/#comments

sgdc3 commented 8 years ago

FactionsChat's developer is inactive, we can't do nothing to fix this.

MithrandirCraft commented 8 years ago

His last connection was 19 hours ago

http://dev.bukkit.org/bukkit-plugins/factionchat/

His project isn't abandoned.

How about just blocking chat reading untill the user logs in? That would solve any issues with Faction Chat, and any other private chat system (To which I could switch if FactionChat dies).

Would that be possible? I'm guessing it would conflict with recieving the authme messages... Maybe they could bypass this block? I would just use signs in any case, when I manage to safely reestablish the Authme Spawn on login without inventories breaking.

Xephi commented 8 years ago

FactionChat use some permission to allow moderator chat reading, isn't it ? Also remove it to unlogged players :O

MithrandirCraft commented 8 years ago

Authme config:

unLoggedinGroup: prelogin

PEX permissions:

groups: prelogin: permissions:

It's no use, does this feature work properly? Am I doing something wrong?

sgdc3 commented 8 years ago

Pex + negative permission nodes = Nope :P Pex neg nodes are broken in latest versions.

MithrandirCraft commented 8 years ago

What? I always thought they worked, but other negative perms seem to be working :S, I was actually taught this function by a PEX dev.

In any case, if I can't negate a permission, what can I do?

I will try:

permissions: []

Assuming faction chat permissions are off by default.

sgdc3 commented 8 years ago

Should have been fixed, can you check latest dev build?

MithrandirCraft commented 8 years ago

Still not fixed. screenshot_1

sgdc3 commented 8 years ago

Custom fchat build: http://ci.xephi.fr/job/FactionsChat-AuthMeFix/

sgdc3 commented 8 years ago

@MithrandirCraft

MithrandirCraft commented 8 years ago

Did you actually modify the Faction Chat plugin?

Just tried it, commands don't work.

sgdc3 commented 8 years ago

Any error? Is the plugin correctly loaded?

MithrandirCraft commented 8 years ago

@sgdc3 The plugin shows up as green "loaded" on /plugins list.

However, there are some errors which I think have to do with this issue:

http://hastebin.com/cibusewafa.avrasm http://hastebin.com/imoxiwajem.avrasm

MithrandirCraft commented 8 years ago

By the way, the current situation with this issue is that right now, using Authme Reloaded + the last official version of FactionChat, moderator chat doesn't work.

sgdc3 commented 8 years ago

even if logged in

MithrandirCraft commented 8 years ago

it seems you have stopped the visualization and usage of that chat all together xD both when logged in and logged out.

sgdc3 commented 8 years ago

ah, right. Fchat author needs to recompile the plugin

sgdc3 commented 8 years ago

and remove any authme hook

sgdc3 commented 8 years ago

not an authme issue anymore

MithrandirCraft commented 8 years ago

Ok, the moderator chat is back again, but it can still be read when logged out: /logout

MithrandirCraft commented 8 years ago

https://github.com/James137137/FactionChat/issues/12#event-504269111

MithrandirCraft commented 8 years ago

Still readable.

MithrandirCraft commented 8 years ago

Updated affected versions of both plugins.

Xephi commented 8 years ago

https://github.com/James137137/FactionChat/pull/14

I've directly pull request him with the fix

MithrandirCraft commented 8 years ago

Fixed with the suspicious FactionChat build that Xephi handed to me.

Xephi commented 8 years ago

LOL , it's just a build with the pull request i've send to the dev of FactionChat ;)

MithrandirCraft commented 8 years ago

I know, I'm just joking xD Thanks :D