search

ImpactDevelopment / ImpactIssues

Please use this repo to report bugs and request features
https://impactclient.net/
221 stars 36 forks source link

Security Issue With Commands #2352

Open ThisTestUser opened 4 years ago

ThisTestUser commented 4 years ago

I'm not sure if this bug has been fixed, but there is currently an issue with plugins like this (https://www.spigotmc.org/resources/%DB%9Egk-%E2%80%A2-anticheat%DB%9E-protect-your-server-from-hackers-and-bots.75691/) abusing the ClickEvent feature to send commands starting with ".". The best way to fix this is to prevent the Impact command system from being triggered when the ClickEvent is fired. (When the user clicks on the chat message, sendMessage from Screen.class is ran with toHud set to false.)

Thunder33345 commented 4 years ago

rebinding prefix from . also works...