search

Hidendra / LWC

Lightweight Protection for Chests, Furnaces, Dispensers, and more for the Minecraft server mod Bukkit
Other
167 stars 123 forks source link

Opening Locked Chests Exploit #606

Open SpaZMonKeY777 opened 11 years ago

SpaZMonKeY777 commented 11 years ago

I am reporting this via information my wife has texted me, so I am reporting this now, and will supply more information when I get home in a few hours.

But basically, a player on our server announced in global chat that you could bypass the LWC protection by holding any spawn egg in your hand. Skeptical, my wife used an alt account of hers (Doesn't have OP or any super permissions) and went up to a locked chest with a spawn egg, and WAS able to open it.

She said it prompts you with "That chest is locked with a magical spell" but opens anyways, and allows you to take items from it. Pretty big issue if this affects anyone using LWC.

We use a recent version of LWC and a recent version of Spigot. I will get exact versions when I am home and add to this report when I am home.

SpaZMonKeY777 commented 11 years ago

UPDATE: So we recently added a plugin called BreedingLimiter (dev.bukkit.org/server-mods/breedinglimiter/) and for some reason, I thought I would try disabling it and test this bug. Sure enough, the exploit is gone once it's disabled. I would assume this is on the BreedingLimiter's side of coding that is causing this, but I thought I would report it here too, so people know :)

bobeeb commented 11 years ago

confirmed, same exploit at our server possible. breeding limiter is now disabled until its fixed. thnx for the info

fpigerre commented 11 years ago

Confirmed. Re-tested on local server.