search

Lothrazar / Cyclic

Minecraft mod written in Java
MIT License
156 stars 93 forks source link

Item frame pass-through allows players to open chests on claimed chunks that they do not own. #1208

Closed ndrader closed 4 years ago

ndrader commented 4 years ago

Minecraft Version: 1.12.2

Forge Version: forge-1.12.2-14.23.5.2836-universal.jar

Mod Version: Cyclic-1.12.2-1.19.12.jar

Sponge Version: spongeforge-1.12.2-2838-7.1.7-RC3785.jar

Modpack: Dungeons, Dragons, and Space Shuttles version 5.6a.

Single Player or Server: Server

Describe the problem (what you were doing; what happened; what should have happened):

  1. Player A claims chunks with ftb utils, places chests or other chests like inventories with item frames on them.
  2. Player B not part of the claimed chunks team can then click on the item frame to access the chest.

Turning off the pass-through config: #Open chests (and other containers) by passing right through the attached signs, banners, and item frames [default: true] B:"Pass-Through Click"=false Fixes this issue, though I would see this as unintended behavior.

If you need more information please let me know.

Lothrazar commented 4 years ago

Sounds like the chunk claiming mod has some security flaws.

Theres no built-in security API into forge so i never know how to deal with these types of things

But yeah turning that config will avoid the issue