DevotedMC / NameLayer

A Citadel reinforcement group manager. Allows the creation of groups in Minecraft. Built for Spigot 1.14.4
https://build.devotedmc.com/job/Namelayer-master/
BSD 3-Clause "New" or "Revised" License
3 stars 8 forks source link

Fix group scan exploit #40

Closed henrydraton closed 3 years ago

henrydraton commented 5 years ago

The nlip command currently suffers from a bug that allows scanning groups for who is a member. This edit should solve the problem by reordering the permission check to before checking for if the player is in the group already.

DevotedServant commented 5 years ago

Can one of the admins verify this patch? @ProgrammerDan @Maxopoly

"ok to test" will build any commits made to this PR "test this please" will build this PR once "retest this please" will make another single build for this PR "add to whitelist" will whitelist the creator of this PR and make jenkins automatically build any PRs made by him

ProgrammerDan commented 5 years ago

Thanks, I'll look this over. There's a boatload of active exploits of this nature, Max and I had some rewrites / reworks for tab complete versions of this in the wings... really need to dive back in here.

That said, thank you for this, much appreciated.

What level of testing have you done on this PR?

On Thu, Aug 1, 2019 at 10:41 AM Bot Bottinson notifications@github.com wrote:

Can one of the admins verify this patch? @ProgrammerDan https://github.com/ProgrammerDan @Maxopoly https://github.com/Maxopoly

"ok to test" will build any commits made to this PR "test this please" will build this PR once "retest this please" will make another single build for this PR "add to whitelist" will whitelist the creator of this PR and make jenkins automatically build any PRs made by him

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/DevotedMC/NameLayer/pull/40?email_source=notifications&email_token=AADD5DXAPQQ3OLWAOLPXWALQCLY2XA5CNFSM4IIRM7P2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD3K2HWI#issuecomment-517317593, or mute the thread https://github.com/notifications/unsubscribe-auth/AADD5DWXYZRMZMDIBCLK4TTQCLY2XANCNFSM4IIRM7PQ .

henrydraton commented 5 years ago

Zero... I do not have a working way to test them.

ProgrammerDan commented 5 years ago

No worries! I'll trigger a test build, then you can grab the .jar from the build server and use it for test.

On Thu, Aug 1, 2019 at 10:45 AM henrydraton notifications@github.com wrote:

Zero... I do not have a working way to test them.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/DevotedMC/NameLayer/pull/40?email_source=notifications&email_token=AADD5DSUVR32SAKT5E4QGVTQCLZJHA5CNFSM4IIRM7P2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD3K2UHI#issuecomment-517319197, or mute the thread https://github.com/notifications/unsubscribe-auth/AADD5DQ3KJNTWGXAVYVGUWTQCLZJHANCNFSM4IIRM7PQ .

ProgrammerDan commented 5 years ago

ok to test

ProgrammerDan commented 5 years ago

hmm, something's up with the build site. might be a hot minute before I can fix it, thanks for patience.

ProgrammerDan commented 5 years ago

ok to test

ProgrammerDan commented 5 years ago

built artifact for testing here: https://build.devotedmc.com/job/Namelayer-pullrequest/13/