ChestShop-authors / ChestShop-3

ChestShop - the chest & sign shop plugin for Minecraft Servers running Bukkit/Spigot/Paper
https://dev.bukkit.org/projects/chestshop
GNU Lesser General Public License v2.1
276 stars 176 forks source link

Sign allows access to chest leaving them open to other players #300

Open Poopibutt opened 4 years ago

Poopibutt commented 4 years ago

Plugin Version:  3.10.1

Plugin Config:

Do you want to turn off the automatic updates of ChestShop?

TURN_OFF_UPDATES: false

How large should the internal caches be?

CACHE_SIZE: 1000

What containers are allowed to hold a shop? (Only blocks with inventories work!)

SHOP_CONTAINERS:

(In 1/1000th of a second) How often can a player use the shop sign?

SHOP_INTERACTION_INTERVAL: 250

Do you want to allow using shops to people in creative mode?

IGNORE_CREATIVE_MODE: true

Do you want to allow using shops to people who have access to it due to their permissions? (owners are always ignored)

IGNORE_ACCESS_PERMS: true

If true, people will buy with left-click and sell with right-click.

REVERSE_BUTTONS: false

If true, people will be able to buy/sell in 64 stacks while holding the crouch button.

SHIFT_SELLS_IN_STACKS: false

What can you do by clicking shift with SHIFT_SELLS_IN_STACKS turned on? (ALL/BUY/SELL)

SHIFT_ALLOWS: "ALL"

Can shop's chest be opened by owner with right-clicking a shop's sign?

ALLOW_SIGN_CHEST_OPEN: true

If true, when you left-click your own shop sign you won't open chest's inventory, but instead you will start destroying the sign.

ALLOW_LEFT_CLICK_DESTROYING: true

If true, if the shop is empty, the sign is destroyed and put into the chest, so the shop isn't usable anymore.

REMOVE_EMPTY_SHOPS: false

If true, if the REMOVE_EMPTY_SHOPS option is turned on, the chest is also destroyed.

REMOVE_EMPTY_CHESTS: false

A list of worlds in which to remove empty shops with the previous config. Case sensitive. An empty list means all worlds.

REMOVE_EMPTY_WORLDS:

First line of your Admin Shop's sign should look like this:

ADMIN_SHOP_NAME: "Admin Shop"

The economy account which Admin Shops should use and to which all taxes will go

SERVER_ECONOMY_ACCOUNT: ""

Percent of the price that should go to the server's account. (100 = 100 percent)

TAX_AMOUNT: 0

Percent of the price that should go to the server's account when buying from an Admin Shop.

SERVER_TAX_AMOUNT: 0

Amount of money player must pay to create a shop

SHOP_CREATION_PRICE: 0

How much money do you get back when destroying a sign?

SHOP_REFUND_PRICE: 0

How many decimal places are allowed at a maximum for prices?

PRICE_PRECISION: 2

Should we block shops that sell things for more than they buy? (This prevents newbies from creating shops that would be exploited)

BLOCK_SHOPS_WITH_SELL_PRICE_HIGHER_THAN_BUY_PRICE: true

Do you want to allow other players to build a shop on a block where there's one already?

ALLOW_MULTIPLE_SHOPS_AT_ONE_BLOCK: false

Can shops be used even when the buyer/seller doesn't have enough items, space or money? (The price will be scaled adequately to the item amount)

ALLOW_PARTIAL_TRANSACTIONS: true

Can '?' be put in place of item name in order for the sign to be auto-filled?

ALLOW_AUTO_ITEM_FILL: true

Enable this if you use BungeeCord and want players to receive shop notifications on other servers

BUNGEECORD_MESSAGES: false

Do you want to show "Out of stock" messages?

SHOW_MESSAGE_OUT_OF_STOCK: true

Do you want to show "Full shop" messages?

SHOW_MESSAGE_FULL_SHOP: true

How many seconds do you want to wait before showing notifications for the same shop to the owner again?

NOTIFICATION_MESSAGE_COOLDOWN: 10

Can players hide the "Out of stock" messages with /cstoggle?

CSTOGGLE_TOGGLES_OUT_OF_STOCK: false

Can players hide the "Full shop" messages with /cstoggle?

CSTOGGLE_TOGGLES_FULL_SHOP: false

Do you want to show "You bought/sold... " messages?

SHOW_TRANSACTION_INFORMATION_CLIENT: true

Do you want to show "Somebody bought/sold... " messages?

SHOW_TRANSACTION_INFORMATION_OWNER: true

If true, plugin will log transactions in its own file

LOG_TO_FILE: false

Do you want ChestShop's messages to show up in console?

LOG_TO_CONSOLE: true

Should all shop removals be logged to the console?

LOG_ALL_SHOP_REMOVALS: true

Do you want to stack all items up to 64 item stacks?

STACK_TO_64: false

Do you want to use built-in protection against chest destruction?

USE_BUILT_IN_PROTECTION: true

Do you want to have shop signs "stick" to chests?

STICK_SIGNS_TO_CHESTS: true

EXPERIMENTAL: Do you want to turn off the default protection when another plugin is protecting the block? (Will leave the chest visually open - CraftBukkit bug!)

TURN_OFF_DEFAULT_PROTECTION_WHEN_PROTECTED_EXTERNALLY: false

Do you want to turn off the default sign protection? Warning! Other players will be able to destroy other people's shops!

TURN_OFF_SIGN_PROTECTION: false

Do you want to disable the hopper protection, which prevents Hopper-Minecarts from taking items out of shops?

TURN_OFF_HOPPER_PROTECTION: false

Do you want to protect shop chests with LWC?

PROTECT_CHEST_WITH_LWC: false

Of which type should the container protection be? Possible type: public, private, donate and on some LWC versions display

LWC_CHEST_PROTECTION_TYPE: "PRIVATE"

Do you want to protect shop signs with LWC?

PROTECT_SIGN_WITH_LWC: false

Of which type should the sign protection be? Possible type: public, private, donate and on some LWC versions display

LWC_SIGN_PROTECTION_TYPE: "PRIVATE"

Should the chest's LWC protection be removed once the shop sign is destroyed?

REMOVE_LWC_PROTECTION_AUTOMATICALLY: true

Do you want to only let people build inside WorldGuard regions?

WORLDGUARD_INTEGRATION: false

Do you want to only let people build inside region flagged by doing /region regionName flag allow-shop allow?

WORLDGUARD_USE_FLAG: false

Do you want ChestShop to respect WorldGuard's chest protection?

WORLDGUARD_USE_PROTECTION: false

Do you want to only let people build inside GriefPrevention claims?

GRIEFPREVENTION_INTEGRATION: false

Do you want to only let people build inside RedProtect regions?

REDPROTECT_INTEGRATION: false

Do you want to deny shop access to unlogged users?

AUTHME_HOOK: true

Do you want to allow shop access to unregistered users? (Example: registration is optional)

AUTHME_ALLOW_UNREGISTERED: false

How much Heroes exp should people get for creating a ChestShop?

HEROES_EXP: 100.0

Add icons and make item names hoverable in transaction messages when ShowItem is installed?

SHOWITEM_MESSAGE: true

Server Version: Spigot 1.14.4

 

Server Log: 06.04 20:24:40 [Server] Server thread/INFO CONSOLE issued server command: /list 06.04 20:24:40 [Server] Server thread/INFO default: [Default] PoopiButt 06.04 20:24:40 [Server] Server thread/INFO peasant: [Peasant] TheMisfit 06.04 20:25:58 [Server] Server thread/INFO Plugins (13): LuckPerms, ezBroadcast, WorldEdit, sleep-most, Vault, WorldGuard, DiscordSRV, Essentials, EssentialsChat, ezAuctions, EssentialsSpawn, GriefPrevention, ChestShop 06.04 20:27:44 [Server] Server thread/INFO TheMisfit placed a sign @ Adventure Craft: x342, z174;10;B 20 : 15 S;dirt 06.04 20:27:44 [Server] Craft Scheduler Thread - 132/INFO TheMisfit created a shop - 10 Dirt - B 20 : 15 S - at [Adventure Craft] 342, 65, 174 06.04 20:27:45 [Server] Server thread/INFO CONSOLE issued server command: /list 06.04 20:27:45 [Server] Server thread/INFO default: [Default] PoopiButt 06.04 20:27:45 [Server] Server thread/INFO peasant: [Peasant] TheMisfit 06.04 20:27:56 [Server] Server thread/INFO PoopiButt issued server command: /time set day 06.04 20:30:51 [Server] Server thread/INFO CONSOLE issued server command: /list 06.04 20:30:51 [Server] Server thread/INFO default: [Default] PoopiButt 06.04 20:30:51 [Server] Server thread/INFO peasant: [Peasant] TheMisfit 06.04 20:33:57 [Server] Server thread/INFO CONSOLE issued server command: /list 06.04 20:33:57 [Server] Server thread/INFO default: [AFK][Default] PoopiButt 06.04 20:33:57 [Server] Server thread/INFO peasant: [Peasant] TheMisfit 06.04 20:35:53 [Disconnect] User TheMisfit has disconnected, reason: Disconnected 06.04 20:35:53 [Server] Server thread/INFO TheMisfit left the game 06.04 20:36:21 [Multicraft] Auto-saving world... 06.04 20:36:22 [Server] Server thread/INFO Saving is already turned on 06.04 20:36:22 [Server] Server thread/INFO Saving the game (this may take a moment!) 06.04 20:36:22 [Server] Server thread/INFO Saved the game 06.04 20:37:03 [Server] Server thread/INFO CONSOLE issued server command: /list 06.04 20:37:03 [Server] Server thread/INFO default: [AFK][Default] PoopiButt 06.04 20:40:09 [Server] Server thread/INFO CONSOLE issued server command: /list 06.04 20:40:09 [Server] Server thread/INFO default: [AFK][Default] PoopiButt 06.04 20:43:15 [Server] Server thread/INFO CONSOLE issued server command: /list 06.04 20:43:15 [Server] Server thread/INFO default: [AFK][Default] PoopiButt 06.04 20:46:21 [Server] Server thread/INFO CONSOLE issued server command: /list 06.04 20:46:21 [Server] Server thread/INFO default: [Default] PoopiButt 06.04 20:49:27 [Server] Server thread/INFO CONSOLE issued server command: /list 06.04 20:49:27 [Server] Server thread/INFO default: [AFK][Default] PoopiButt 06.04 20:52:33 [Server] Server thread/INFO CONSOLE issued server command: /list 06.04 20:52:33 [Server] Server thread/INFO default: [AFK][Default] PoopiButt 06.04 20:53:07 [Multicraft] Auto-saving world... 06.04 20:53:07 [Server] Server thread/INFO Saving is already turned on 06.04 20:53:07 [Server] Server thread/INFO Saving the game (this may take a moment!) 06.04 20:53:08 [Server] Server thread/INFO Saved the game 06.04 20:55:39 [Server] Server thread/INFO CONSOLE issued server command: /list 06.04 20:55:39 [Server] Server thread/INFO default: [Default] PoopiButt 06.04 20:56:10 [Server] User Authenticator #18/INFO UUID of player HappyBlueBalls is 05329eac-8b51-4f3c-b930-b0fab4a77b66 06.04 20:56:10 [Connect] User HappyBlueBalls, IP 47.24.0.189 06.04 20:56:11 [Multicraft] HappyBlueBalls ran command Message of the Day 06.04 20:57:13 [Server] User Authenticator #19/INFO UUID of player xoMusicGirl is d5bc177d-1b27-425c-b0b6-ca5052e992a3 06.04 20:57:13 [Connect] User xoMusicGirl, IP 98.151.112.166 06.04 20:57:13 [Multicraft] xoMusicGirl ran command Message of the Day 06.04 20:58:45 [Server] Server thread/INFO CONSOLE issued server command: /list 06.04 20:58:45 [Server] Server thread/INFO default: [AFK][Default] PoopiButt 06.04 20:58:45 [Server] Server thread/INFO peasant: [Peasant] xoMusicGirl 06.04 20:58:45 [Server] Server thread/INFO peasant+: [Peasant+] HappyBlueBalls 06.04 21:01:26 [Server] Server thread/WARN HappyBlueBalls moved too quickly! 9.194336093192533,-1.537505364790519,6.595385064093534 06.04 21:01:26 [Server] Server thread/WARN Can't keep up! Is the server overloaded? Running 5459ms or 109 ticks behind 06.04 21:01:51 [Server] Server thread/INFO CONSOLE issued server command: /list 06.04 21:01:51 [Server] Server thread/INFO default: [AFK][Default] PoopiButt 06.04 21:01:51 [Server] Server thread/INFO peasant: [Peasant] xoMusicGirl 06.04 21:01:51 [Server] Server thread/INFO peasant+: [Peasant+] HappyBlueBalls 06.04 21:02:10 [Server] User Authenticator #20/INFO UUID of player TheMisfit is e947b681-6ab3-4d08-b0c9-846b65153d0f 06.04 21:02:10 [Connect] User TheMisfit, IP 73.206.157.246 06.04 21:02:10 [Multicraft] TheMisfit ran command Message of the Day 06.04 21:02:30 [Server] Server thread/INFO HappyBlueBalls issued server command: /home

What other plugins are you running? LuckPerms, ezBroadcast, WorldEdit, sleep-most, Vault, WorldGuard, DiscordSRV, Essentials, EssentialsChat, ezAuctions, EssentialsSpawn, GriefPrevention, ChestShop

What is happening? Sign is allowing players into a protected shop to take anything. When clicking on the chest itself it says "you do not have access to that." but the sign lets them in anyways.

Pic shows me clicking a protected chest with the server response: https://imgur.com/516vUeq Pic shows me clicking on the sign gaining access to the chest: https://imgur.com/4dhuDmW Pic showing the sign letting me in the protected chest: https://imgur.com/MBUSIz5

What did you expect to happen? Whenever you click on the sign it buys or sells an item.

Phoenix616 commented 4 years ago

Please make sure that you test this with normal permissions and not with special admin access ones. It's definitely not default behaviour to open other's shops if one doesn't have permission to do so (and it looks like some other plugin is blocking it, that error message isn't from chestshop)

If you don't want that functionality at all then disable the ALLOW_SIGN_CHEST_OPEN config option.

Poopibutt commented 4 years ago

Please make sure that you test this with normal permissions and not with special admin access ones. It's definitely not default behaviour to open other's shops if one doesn't have permission to do so (and it looks like some other plugin is blocking it, that error message isn't from chestshop)

If you don't want that functionality at all then disable the ALLOW_SIGN_CHEST_OPEN config option.

I have Deoped myself and redid all perms, Created myself as a Default tried and it still let me in. Had other default players with no ranks or extra perms to try and it was still broken. The plugin you're seeing is "GriefPrevention" I'm positive that all my plugins are for the correct version Spigot 1.14.1.