LOOHP / ImageFrame

Put images on maps and walls!
https://www.spigotmc.org/resources/106031/
GNU General Public License v3.0
43 stars 12 forks source link

Do not give full access permissions default true! #62

Closed TomLewis closed 1 month ago

TomLewis commented 1 month ago

Just got the shock of my life just now on my survival, that ANYONE could make a map from any URL in survival as I had not given anyone permission to do this.

You can give default permissions to OPs but not everyone! thats nuts.

I have just blanked blocked them from being able to run the command(s) as this should be treated as an admin tool!

Now we can police random images being created at will!

LOOHP commented 1 month ago

You can always deny default permissions by denying the person in the default permission group.

TomLewis commented 1 month ago

Thats what I just did, but It was massive shock to see that the plugin defaults to ALL on as a default, backwards and dangerious.

Because this isnt how I expect a plugin to work, I didnt think to check its defaults.

Imagine if for 2 months peolpe had been sharing porn images without my knowledge as I expect the plugin to require permissions to use.

Just from a saftey perspective, let alone if a hacker decided to just spam billions of maps and use them all up, as the default for users is set to infinite! At the very least set this to like 1000 or something.

LOOHP commented 1 month ago

Normal players have a limited amount of maps they can create. And each map has a limited size. The plugin was designed to be survival friendly. Of course, if you have a huge server, then most supposed survival friendly plugin will need extra configuration from admins.

TomLewis commented 1 month ago

Thats fine, I was just super shocked it was open to all off the bat and wanted to not cause anyone else any issues in the future. Your call at the end of the day, I just suggest no perms until given them as default to match whats expected.

Thanks for your very quick reply and thanks for making such a fantastic plugin.