Lothrazar / Cyclic

Minecraft mod written in Java
MIT License
156 stars 95 forks source link

User and Block placer bypass all Claim protections #2385

Open Saereth opened 3 months ago

Saereth commented 3 months ago

Minecraft Version: 1.19.2 but also 1.20 and possibly other versions of the mod

Forge Version: 43.8.3

Mod Version: 1.8.2

Single Player or Server: both

Describe problem (what you were doing; what happened; what should have happened):

in your user and placer code you directly call setblock instead of placing it with a fakeplayer. This allows people to use your block to bypass claims, grief claimed areas and even bypass spawn protections. In particularly https://github.com/Lothrazar/Cyclic/blob/eb0cac17a9ea3c992776378f52cebcc95be1b1a6/src/main/java/com/lothrazar/cyclic/block/placer/BlockPlacer.java#L45

and

https://github.com/Lothrazar/Cyclic/blob/eb0cac17a9ea3c992776378f52cebcc95be1b1a6/src/main/java/com/lothrazar/cyclic/block/user/BlockUser.java#L45

and potentially your dropper/peat farm

Basically if you use a fake player and call something like

if (fakePlayer.placeBlock(this.level, blockState, blockItem))
{
///
}

instead of .setBlock it will allow that to fail instead of bypassing protections.