All Users Can Run /we update

boy0001 / FastAsyncWorldedit

Blazingly fast world manipulation for artists, large networks and developers: https://www.spigotmc.org/resources/13932/

GNU General Public License v3.0

310 stars 225 forks source link

All Users Can Run /we update #1344

Closed jakkuh closed 4 years ago

jakkuh commented 4 years ago

There doesn't seem to be any permission check for the /we update command as all users can run it with the response "No update is pending". I'm not sure if they can actually update it with it (and restart the server in the process), but it's kind of janky to have that command exposed.

MC Ver: 1.12.2 (paper 1618) FAWE Ver: Latest for 1.12.2 (https://i.imgur.com/fdGe7h6.png)

NotMyFault commented 4 years ago

They shouldn't be able to restart the server. Also, respect the template and don't delete it.