Opening this as a tracking issue (I'm already working on it).
Many of glowcase's packet handlers don't check that the player is in creative mode, has permission to edit the glowcase in question, etc.
Additionally, the packet code is needlessly complex. Sometimes a roundtrip is done to the server for something that can easily be done on the client (like "opening the 'open url confirmation' screen").
Opening this as a tracking issue (I'm already working on it).
Many of glowcase's packet handlers don't check that the player is in creative mode, has permission to edit the glowcase in question, etc.
Additionally, the packet code is needlessly complex. Sometimes a roundtrip is done to the server for something that can easily be done on the client (like "opening the 'open url confirmation' screen").