search

ObelusPA / CreativeParkour

Bukkit parkour plugin that allows all the players to play and show their skills in fun parkour maps they build or download!
https://creativeparkour.net
GNU General Public License v3.0
3 stars 9 forks source link

Able to bypass WorldEdit region restriction via boat #10

Closed RoboMWM closed 6 years ago

RoboMWM commented 6 years ago

So a player was testing all the ways he could try to break my CreativeParkourMaps world today.

One way he was able to do so was via WorldEditing the barrier blocks out (he did it via //move though I haven't tested if just selecting it with the wand is enough), and place a boat to get out of the plot. CreativeParkour doesn't detect this (I'm guessing this isn't a PlayerMoveEvent that's fired), so the player stays in creative until they exit the boat, despite being outside of the plot. But what confuses me is that they are able to Worldedit outside of their plot while doing so!

For the moment, I've disabled vehicle placement to mitigate this issue, but am curious if you could look into your WorldEdit restrictions and see if it's possible to lock it to the plot CreativeParkour believes they're in (and while you're at it, also to prevent them from worldediting the barrier and bedrock blocks possibly).

ObelusPA commented 6 years ago

Vehicle placement is already supposed to be disabled in CreativeParkour, and WorldEdit is not supposed to work on the barrier blocks, that's weird. I will take a look at this as soon as I get less busy.

RoboMWM commented 6 years ago

It's probably because it's being placed at the edge (where the barrier blocks are).

ObelusPA commented 6 years ago

I checked everything, and CreativeParkour never gives the permission for //move, you may check your server configuration. I will make these things more secure anyway.

RoboMWM commented 6 years ago

Oh, so you instead just don't support some worldedit actions... ok.