search

GeyserMC / Floodgate-Modded

Port of the hybrid mode plugin called Floodgate for Fabric and NeoForge to allow for connections from Geyser to join online mode servers.
MIT License
52 stars 18 forks source link

Player Linking requires administrator privileges #131

Closed Markil3 closed 2 months ago

Markil3 commented 2 months ago

According to the following: https://github.com/GeyserMC/Floodgate-Fabric/blob/4502fd20cd523ff1ceda53e8f87bbd3957dbc5d7/src/main/java/org/geysermc/floodgate/util/FabricCommandUtil.java#L77 all commands related to Floodgate Fabric require administrator privileges in order to run. This includes account linking. This does not make sense, in my opinion. Being able to switch between Java and Bedrock clients should be something that any player can do. However, as it is, the only way to accomplish this besides manually editing the database is to temporarily give both the Java and Bedrock accounts administrator privileges and trust them to run only the linkaccount command. This is an unacceptable security hole. Perhaps we could consider adding a bit more nuance to who gets to run these commands?

onebeastchris commented 2 months ago

That's the fallback permission level that is required if a specific permission is not set for a player/user - OP's can bypass permissions. See https://geysermc.org/wiki/floodgate/commands for which permissions you need to grant for players to be able to link accounts. To grant permissions to players, we'd recommend using luckperms.