Players can bring inventory from creative world to survival world by pressing 'E'

[1337ingDisorder]

I've been informed by a player on my server that there's a glitch with version 2.5-b335 of Multiverse-Inventories wherein players can bring infinite resources from one world into the other, circumventing Multiverse-Inventories' efforts to keep the two worlds' inventories separate.

I've tested this and can confirm that it can be reproduced, the technique is a little tricky to master but it works every time once you get it right.

Essentially it's just a matter of timing:

1) go into the Creative Mode world

2) Load up your personal inventory with emerald blocks, spawn eggs, and all sorts of other goodies that completely throw off the economy and game-play in the Survival Mode world

3) Warp, teleport, or use a Multiverse Portal to move into the Survival Mode world. Just as the world is changing over, hit the 'E' key to bring up your inventory GUI window.

Voila! You now have your full personal inventory from the Creative World. Now you can spend those emeralds, spawn those creepers, and generally run amok in the Survival World.

Versions:

Bukkit: git-Bukkit-1.4.7-R1.0-94-g141dcf0-b2735jnks (MC: 1.5.1) Multiverse-Core: 2.5-b641 (beta) Multiverse-Inventories: 2.5-b335 Multiverse-Portals: 2.4-AB (though the glitch works even with Multiverse-Portals disabled, when users teleport or warp from one world to the other)

Server:

CentOS 5.5 2GB Dedicated RAM 80GB HDD Excellent bandwidth (hosted on RackspaceCloud)

[dumptruckman]

This is likely due to a craftbukkit bug.

[1337ingDisorder]

I'm positive that if I post a ticket on the CraftBukkit ticket system about Multiverse-Inventories not successfully blocking inventory from being transferred from one world to another in a Multiverse deployment, they'll tell me to come post on the Multiverse-Inventories ticket feed.

The problem was present before the 1.5 update but since the 1.5 update was right around the corner when I found out about the bug I figured I'd see if the new version fixed it.

Didn't think to check until today, and sure enough the bug is still there.

Regardless of whether it's a craftbukkit bug or a Multiverse-Inventories bug, it essentially cripples Multiverse-Inventories to the point of being broken.

Thanks -1337ingDisorder

On 13-04-10 01:11 PM, Jeremy Wood wrote:

This is likely due to a craftbukkit bug.

— Reply to this email directly or view it on GitHub https://github.com/Multiverse/Multiverse-Inventories/issues/161#issuecomment-16198818.

[ammaraskar]

I wouldn't technically call it a craftbukkit problem, its simple enough for us to work around it, when the world changes call closeInventory on the player to force close any containers. In vanilla it doesn't matter if you can keep containers open while teleporting

[dumptruckman]

Let's see if this fixes it http://ci.onarandombox.com/job/Multiverse-Inventories/347/ Please let me know.

[1337ingDisorder]

Wow that's some fast attention right there -- many thanks!!

I've installed this snapshot and I've tested, it seems I'm unable to duplicate the glitch any more but I was never very good at it compared to the person who showed me... He can do it every single time, so when he's on later today I'll have him run it through the ringer and see if he's been cockblocked :)

Thanks again for the snappy response time, it's definitely appreciated! Will let you know as soon as I have definite confirmation of the fix.

• -

On 13-04-10 02:16 PM, Jeremy Wood wrote:

Let's see if this fixes it http://ci.onarandombox.com/job/Multiverse-Inventories/347/ Please let me know.

— Reply to this email directly or view it on GitHub https://github.com/Multiverse/Multiverse-Inventories/issues/161#issuecomment-16202790.

[1337ingDisorder]

Okay so the guy who's an expert at reproducing the glitch came on, and even with this new update the glitch is still reproduce-able. My timing isn't as sharp as his, but when he said he could still do it I spent 10 minutes trying to do it again and I can indeed confirm that the bug is still present, as I've been able to do it 3 times in the past few minutes.

Same results as before -- load up inv in creative, use any means to go to the survival world (/warp, /back, /tp, /home, etc) and if you hit 'E' at just the right time while the worlds are switching over, your inventory carries over to the survival world.

I'm not sure if this will help but in all the times I've been successful in duplicating the results, the inventory GUI popped up briefly in the creative world right as it was switching over. Every time I do it and don't get the GUI up in time, the glitch fails and my inventories are kept separate. This may be coincidental but I thought it was worth mentioning.

Thanks again for getting on top of this so quickly!

[dumptruckman]

Please try http://ci.onarandombox.com/job/Multiverse-Inventories/350/ and let me know if it fixes it. Thanks!

[1337ingDisorder]

Bug still present, same results.

I'll be around if you need testing on further fix candidates :)

Thanks again

On 13-04-10 06:13 PM, Jeremy Wood wrote:

Please try http://ci.onarandombox.com/job/Multiverse-Inventories/350/ and let me know if it fixes it. Thanks!

— Reply to this email directly or view it on GitHub https://github.com/Multiverse/Multiverse-Inventories/issues/161#issuecomment-16211984.

[dumptruckman]

Can you set up a test server with JUST MV-Core and MV-Inventories and see if you can still reproduce this?

[1337ingDisorder]

Well I'm starting to feel a little sheepish..

I set up a test server as instructed and when I use /mv tp I'm unable to reproduce the glitch.

I've gone back on my main server and I can reproduce the glitch with relative ease using /back or /home etc, but I can't seem to get it to work with /mv tp. Sometimes it seems like it's working for a split second, then the inv clears back to the separate inventory like it's supposed to under non-glitchy circumstances.

I double-checked with the guy who brought the glitch to my attention and it seems that he's never actually tried by going through an MV Portal either, all the methods he used to reproduce the glitch were done using /back or /home or /tpa etc etc (all commands from the Essentials plugin).

So it seems, from what I can tell, that MV-Inv is indeed working as it should and the glitch is more likely caused by Essentials somehow.

I want to leave some time before closing the ticket, so that I can have the other guy test using /mv tp in case it's just my timing that's off, but I'm fairly confident it's an Essentials issue.

Thanks again, will let you know as soon as I have a definitive conclusion!

On 13-04-10 08:31 PM, Jeremy Wood wrote:

Can you set up a test server with JUST MV-Core and MV-Inventories and see if you can still reproduce this?

— Reply to this email directly or view it on GitHub https://github.com/Multiverse/Multiverse-Inventories/issues/161#issuecomment-16215275.

[salaman]

Any update on this? I've been unable to replicate any issues with Essentials commands teleporting through various worlds, but I am also unsure about the particular timing required. I will require Multiverse-Inventories very soon, but don't want to risk any issues with cheating using Essentials.

[dpodp]

I am having this same issue, if you would like here is a video of the gltich in action: http://www.youtube.com/watch?v=ak7uHdBcKug

The only way i can combat this atm is to disable all teleport timers and make then instant in the creative world.

[1337ingDisorder]

Wow that's awesome David, thanks for the video!

This is perfect too because it shifts the focus back to MultInv -- in this video you're using /f home so the factions-based teleport.

In my experience the problem is present when using Essentials-based teleports like /home or /back

So it would seem this problem extends beyond just Essentials and is something MultInv is going to have to tackle on its own.

[salaman]

I can confirm this issue as well. I used Essential's /tpa with a cooldown and it duplicated my items.

Thanks for the report, I've temporarily disabled the creative world I run to mitigate the issue. You also might want to make the video private and link-only for now to help other server admins fix the issue in time before it comes a wide-spread issue.

[1337ingDisorder]

It might be better to leave the video as public - this ticket was created months ago and hasn't been fixed yet.

Maybe if the problem starts spreading like wildfire it'll encourage the devs to get 'er fixed ;)

[dpodp]

Actually that is a video i found on youtube, i did not upload that. Pretty scarely that this has not been fixed for months. Ill look a little throught the code and see if theres anything that pops out at me.

[Wimbo777]

It seems this glitch is on other servers too. I was on some server the other day, creativecrafters, which has a creative world and a survival world, and a friend of mine told me this glitch. It sure as heck worked. if this gets to somewhere where tons of people can see it we may be in for a bit of a disaster.

[Beaupedia]

Has this been addressed yet?

[1337ingDisorder]

On 13-08-27 09:12 PM, Beaupedia wrote:

Has this been addressed yet?

No, the bug is STILL present.

The only way to avoid this bug is to either not use Essentials or to only have Survival and Adventure mode worlds on your server.

If you have a relatively large server you could consider fracturing it into two servers and joining them with Bungee. For that deployment you would have one server with all your Creative Mode worlds and one server with all your Survival and Adventure Mode worlds, and then you have your Bungee server.

People connect to your Bungee server and can then move between your creative and survival worlds within the same virtual server, however in reality the Creative Mode server and the Survival/Adventure server can have completely different sets of plugins, permissions, and general rules.

MultiverseInventories doesn't work across a Bungee connection, so there's no way for people to exploit the inventory glitch if you use the above deployment. (The downside is you need to maintain 3 servers instead of just 1).

Ideally it would be great for the MultiverseInventories devs to liaise with the Essentials dev team to come up with a proper solution, but this bug has been present for so long now that I don't think the Essentials devs even care that their plugin doesn't work properly under the given circumstances and I don't think they ever plan on putting any effort into fixing it without the MultiverseInventories devs lighting a fire under their arses.

[Beaupedia]

This isn't an Essentials issue. We don't use Essentials and it still happens. We use AdminCmd. It's a Multiverse issue, period.

Beau

On Wed, Aug 28, 2013 at 9:03 AM, 1337ingDisorder notifications@github.comwrote:

On 13-08-27 09:12 PM, Beaupedia wrote:

Has this been addressed yet?

No, the bug is STILL present.

The only way to avoid this bug is to either not use Essentials or to only have Survival and Adventure mode worlds on your server.

If you have a relatively large server you could consider fracturing it into two servers and joining them with Bungee. For that deployment you would have one server with all your Creative Mode worlds and one server with all your Survival and Adventure Mode worlds, and then you have your Bungee server.

People connect to your Bungee server and can then move between your creative and survival worlds within the same virtual server, however in reality the Creative Mode server and the Survival/Adventure server can have completely different sets of plugins, permissions, and general rules.

MultiverseInventories doesn't work across a Bungee connection, so there's no way for people to exploit the inventory glitch if you use the above deployment. (The downside is you need to maintain 3 servers instead of just 1).

Ideally it would be great for the MultiverseInventories devs to liaise with the Essentials dev team to come up with a proper solution, but this bug has been present for so long now that I don't think the Essentials devs even care that their plugin doesn't work properly under the given circumstances and I don't think they ever plan on putting any effort into fixing it without the MultiverseInventories devs lighting a fire under their arses.

— Reply to this email directly or view it on GitHubhttps://github.com/Multiverse/Multiverse-Inventories/issues/161#issuecomment-23421773 .

[dpodp]

I am amazed this still hasnt been fixed. The issue arises when the players have a delay in teleporting so they can mess with the inventories.

[Beaupedia]

Please, someone, give us an update. This is MAJOR. It has to be fixed if this plugin can be used. In the meantime, does anyone know of any secure alternatives?

[dumptruckman]

If this is only happening with Essentials it sounds like Essentials may be doing something wacky that is causing this problem. Unfortunately all of my time is currently devoted to other things so I can't really provide any updates for this plugin.

[Beaupedia]

As I mentioned earlier it is NOT happening only with Essentials. It has nothing to do with Essentials. It's the time between landing in the world you're warping to. Regardless of the plugin.

Beau

On Sat, Aug 31, 2013 at 2:04 PM, Jeremy Wood notifications@github.comwrote:

If this is only happening with Essentials it sounds like Essentials may be doing something wacky that is causing this problem. Unfortunately all of my time is currently devoted to other things so I can't really provide any updates for this plugin.

— Reply to this email directly or view it on GitHubhttps://github.com/Multiverse/Multiverse-Inventories/issues/161#issuecomment-23612952 .

[DevTron]

This bug is still around and needs patching!

[FlarupsPige]

Something new about it?

[hafarooki]

I'm getting this bug on my server as well. I have no idea what to do about it, but this is a very, very big bug. Amazing how this hasn't been solved after 2 years.

[dumptruckman]

I have looked into this several times and have been unable to find any solution to the problem. I realize this is a very critical problem but unless someone has some ideas on how to fix it then it's not going to be fixed.

[DevTron]

Unload inventory from client before the world change occurs?

Sent from my iPhone

On Nov 15, 2015, at 8:27 PM, Jeremy Wood notifications@github.com wrote:

I have looked into this several times and have been unable to find any solution to the problem. I realize this is a very critical problem but unless someone has some ideas on how to fix it then it's not going to be fixed.

— Reply to this email directly or view it on GitHub.

[dumptruckman]

The problem with that is that the world change is already occurring by the time i would be able to do that.

[hafarooki]

Strangely, I'm not getting this issue on my local test server - only on the live server.

[hafarooki]

I've also been getting players whose inventories are randomly crossing between worlds - e.g. their Survival inventory got into Spawn, their jail inventory got into Towny, their Towny inventory got into Survival - this is resulting mostly in loss of items, and has been happening since the day before yesterday.

NOTE: The intentional inventory switching glitch seems to be unreproducible with this code in a custom plugin:

@EventHandler
public void playerTeleport(PlayerTeleportEvent event) {
    event.getPlayer().closeInventory();
}

[dumptruckman]

Alright @Miclebrick I added your potential fix. I'm not sure anyone is even using this plugin anymore but if someone could absolutely confirm that build #416 fixes the exploit I may consider reviving the plugin.

[dumptruckman]

Just to add a bit more... I need someone that was able to reproduce this bug reliably before, since I was never able to reproduce it, that can no longer reproduce it in the new build.

My current thoughts on why this bug exists is latency. This could explain why people (including myself) were unable to reproduce it on a test server since those servers are likely on a local lan or even the same machine. It could also explain why servers with more plugins are more likely to experience the bug since having more plugins could potentially reduce the TPS on the server.

[dumptruckman]

This is absolutely related to latency. Was never able to reproduce on local test server. Tried it on a friend's dev server and I could reproduce it every single time.

[dumptruckman]

I have confirmed that this exploit is no longer reproduceable in the latest dev builds!

[Beaupedia]

YES! Thank you so much!

-- Beau

On Mon, Jun 12, 2017 at 1:37 PM, Jeremy Wood notifications@github.com wrote:

I have confirmed that this exploit is no longer reproduceable in the latest dev builds!

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/Multiverse/Multiverse-Inventories/issues/161#issuecomment-307896901, or mute the thread https://github.com/notifications/unsubscribe-auth/ABbbOWSs85L6FZVjhSZx16Vccxh8Oip3ks5sDZOTgaJpZM4AkVXS .

[dumptruckman]

Don't get too excited. Still quite a few other critical bugs to fix...

[ScuroK]

did anyone here test this "fix"? Because PWI has the same problem right now so he tried to fix it like you guys. But i tested it and it didnt work. @dumptruckman Did you do take any other steps rather than closing the inventory on teleport to fix this issue?

[ScuroK]

@dumptruckman Yesterday i tested xInventories and found the same bug aswell!! That means all major inventory plugins are affected! Its just a matter of time untill this bug becomes popular (youtube etc.).

After lots of testing i came up with this idea:

1. Create some kind of "dummy inventory"
2. If a player changes the world this "dummy inventory" will load first. Its function is to act as a transit inventory. If the player uses this bug, the cheated items go into this dummy inventory. Maybe you could even block the dropping of items there. but maybe thats not needed.
3. After a short delay the "dummy inventory" gets cleared and the real inventory loads.

i would do it myself but im not a dev. And its quite sad to see all the developers of inventory plugins became lazy and inactive...

[dumptruckman]

@ScuroK When a bug as devastating as this is easily exploited, it's very easy to lose heart in a project. I wouldn't be surprised if the other inventory plugin devs have experienced the same thing. In fact, I decided this plugin was officially dead as long as this exploit exists.

Now, the question is, are you using the latest dev builds? The fix I implemented caused me to be unable to reproduce the issue on a server where I could reproduce it very easily. If you actually are using the latest build and you are still able to reproduce this issue then I will reopen this issue.

[EbonJaeger]

Heya, PWI guy here. Currently I close the inventory on teleport as you do, and clear everything again before loading the new one. I suppose the question now is if that was indeed the root problem, or if something else is going on. It's a weird one, for sure.

[ScuroK]

@dumptruckman you were not able to reproduce the bug doesnt man you fixed it. If closing the inventory is the only thing you did, then it means this bug is not fixed. Because Gnat did the exact same thing in PWI.

Let me give you an example: On one server it took me much longer to reproduce it than on another server. So i thought this server had it fixed. But i was bored and i had time so i kept trying for 10 more min and BAM i got my diamonds.

I also suggested how to probably fix this bug multiple times. i told it here, i told it to @Gnat008 and i told it to the developer of xInventories: Try to let an additional "dummy inventory" eat those cheated items first, then switch to the actual inventory. From my point of view this makes sence or lets say it is at least worth trying. Or isn't it? But all of you guys just say things like "Hmm i think i did things right. Hmm i think its already fixed. Hm i think its not my fault this bug exists" How does this help the heart of a project? Maybe i'm too swiss to understand this reactions right. Because to me it seems not very motivated and not willing to try things other people suggested.

[ScuroK]

@dumptruckman and yes: i did use the latest snapshot. it was easy AF to glitch the items over..

pls re-open this issue

[dumptruckman]

Please share the information that /mvv -g gives you on server console.

[ScuroK]

[14:29:50 INFO]: [Multiverse-Inventories] Multiverse-Inventories Version: 2.5.0-SNAPSHOT-b444 [14:29:50 INFO]: [Multiverse-Inventories] First Run: false [14:29:50 INFO]: [Multiverse-Inventories] Using Bypass: false [14:29:50 INFO]: [Multiverse-Inventories] Default Ungrouped Worlds: false [14:29:50 INFO]: [Multiverse-Inventories] Using GameMode Profiles: false [14:29:50 INFO]: [Multiverse-Inventories] === Groups === [14:29:50 INFO]: [Multiverse-Inventories] default: {Worlds: [world, world_the_end, world_nether], Shares: [hit_points, economy, food_level, saturation, exhaustion, xp, total_xp, lvl, inventory_contents, armor_contents, bed_spawn, maximum_air, remaining_air, fall_distance, fire_ticks, potion_effects, last_location, ender_chest, off_hand]} [14:29:50 INFO]: [Multiverse-Inventories] welt: {Worlds: [world], Shares: [hit_points, economy, food_level, saturation, exhaustion, xp, total_xp, lvl, inventory_contents, armor_contents, bed_spawn, maximum_air, remaining_air, fall_distance, fire_ticks, potion_effects, last_location, ender_chest, off_hand]} [14:29:50 INFO]: [Multiverse-Inventories] nether: {Worlds: [world_nether], Shares: [hit_points, economy, food_level, saturation, exhaustion, xp, total_xp, lvl, inventory_contents, armor_contents, bed_spawn, maximum_air, remaining_air, fall_distance, fire_ticks, potion_effects, last_location, ender_chest, off_hand]} [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Core] Multiverse-Core Version: 2.5.1-SNAPSHOT-b730 [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Core] Bukkit Version: git-Spigot-bb614f8-e40c9ef (MC: 1.12.2) [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Core] Loaded Worlds: [{"MVWorld@641451617":{"Gen":"null","Type":"NORMAL","Env":"THE_END","Name":"world_the_end"}}, {"MVWorld@822412968":{"Gen":"null","Type":"NORMAL","Env":"NORMAL","Name":"world"}}, {"MVWorld@879607512":{"Gen":"null","Type":"NORMAL","Env":"NETHER","Name":"world_nether"}}, {"MVWorld@1108451448":{"Gen":"null","Type":"FLAT","Env":"NORMAL","Name":"DoctorWhoThemeInMinecraft"}}] [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Core] Multiverse Plugins Loaded: 1 [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Core] Economy being used: Essentials Economy [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Core] Permissions Plugin: Bukkit Permissions (SuperPerms) [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Core] Dumping Config Values: (version 2.9) [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Core] messagecooldown: 5000 [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Core] teleportcooldown: 1000 [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Core] worldnameprefix: true [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Core] worldnameprefixFormat: [%world%]%chat% [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Core] enforceaccess: false [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Core] displaypermerrors: true [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Core] teleportintercept: true [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Core] firstspawnoverride: true [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Core] firstspawnworld: world [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Core] debug: 0 [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Core] Special Code: FRN002 [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Inventories] Multiverse-Inventories Version: 2.5.0-SNAPSHOT-b444 [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Inventories] First Run: false [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Inventories] Using Bypass: false [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Inventories] Default Ungrouped Worlds: false [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Inventories] Using GameMode Profiles: false [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Inventories] === Groups === [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Inventories] default: {Worlds: [world, world_the_end, world_nether], Shares: [hit_points, economy, food_level, saturation, exhaustion, xp, total_xp, lvl, inventory_contents, armor_contents, bed_spawn, maximum_air, remaining_air, fall_distance, fire_ticks, potion_effects, last_location, ender_chest, off_hand]} [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Inventories] welt: {Worlds: [world], Shares: [hit_points, economy, food_level, saturation, exhaustion, xp, total_xp, lvl, inventory_contents, armor_contents, bed_spawn, maximum_air, remaining_air, fall_distance, fire_ticks, potion_effects, last_location, ender_chest, off_hand]} [14:29:50 INFO]: [Multiverse-Core] [Multiverse-Inventories] nether: {Worlds: [world_nether], Shares: [hit_points, economy, food_level, saturation, exhaustion, xp, total_xp, lvl, inventory_contents, armor_contents, bed_spawn, maximum_air, remaining_air, fall_distance, fire_ticks, potion_effects, last_location, ender_chest, off_hand]} [14:29:52 INFO]: [Multiverse-Core] Version info dumped here: http://j.mp/2qEL9Sq

[ScuroK]

@dumptruckman maybe you used some per-gamemode-inventory options when you tested it? This would hide the bug because it would act similar to what i suggested: one inventory would eat the glitched items before loading the actual inventory. but im not sure about this.

it tested it on my local server and had no problems to glitch items over...

[ScuroK]

i just found that even this plugin (which uses player.dat files in the world folders) is affected by this bug awell: https://www.spigotmc.org/resources/myworlds.39594/

[bergerkiller]

Just to pitch in too (what a party!), this is almost certainly a server-side bug. I'll look into it tomorrow, set up some packet listeners on SET_CREATIVE_SLOT, and see how it goes. My assumption is that the server is accepting creative mode set slot packets during a very short time-frame the player is joining a new world. This is likely outside the reach of plugins with bukkit alone, but can be worked around by catching and cancelling the SET_CREATIVE_SLOT packets during a world change.

Honestly this is a bug better fixed in the server software than patched around by individual plugins.

[ScuroK]

@bergerkiller thank you so much for trying to fix this digusting bug! Hope you can find a way! If you need intensive testing, feel free to contact me on spigot ok?