Linking needs to check for LINKING on both sub and super group

Civcraft / NameLayer

Do not open issues here; open them on the maintained fork @ DevotedMC

https://github.com/DevotedMC/NameLayer

BSD 3-Clause "New" or "Revised" License

4 stars 14 forks source link

Linking needs to check for LINKING on both sub and super group #186

Closed ProgrammerDan closed 8 years ago

ProgrammerDan commented 8 years ago

Currently Link is only checking subgroup permission: https://github.com/Civcraft/NameLayer/blob/master/NameLayerMain/src/vg/civcraft/mc/namelayer/command/commands/LinkGroups.java#L63

This means that a MEMBER on a group could "link" a group on which he's OWNER. This will cause issues, and is the source of a trivial exploit to functionally elevate one's own permissions.

Maxopoly commented 8 years ago

Fixed with https://github.com/Civcraft/NameLayer/pull/191