search

connection-lost / LockettePro

LockettePro - A much better Lockette plugin for Bukkit [1.8 - 1.12]
42 stars 59 forks source link

Security leak with S******* #37

Closed k-jiang closed 7 years ago

k-jiang commented 7 years ago

Reported by one of my player, people can pull items from a fully-locked chest with S. Just simply create a [Slot] shop with S and link the sign to the locked chest, then you could easily steal stuffs from it by clicking on the S*** sign.

Tested on S*** version 2.11.0 and LockettePro 2.7.0. Spigot version 1.11.2 with build number 1210.

I'm not sure if it's also broken with the [Buy] shop. May have to give it a try later on.

If you want more info please feel free to ask.

connection-lost commented 7 years ago

I figured out the problem. I'll put down some info here and get back in a minute. https://github.com/connection-lost/LockettePro/blob/master/src/me/crafter/mc/lockettepro/BlockPlayerListener.java#L176 https://github.com/wargamer/SignShop/blob/f552be54a85c976c940b2dcbeda93d84aa2e96a4/org/wargamer2010/signshop/listeners/SignShopPlayerListener.java#L157

connection-lost commented 7 years ago

Meanwhile, please use this temporary fix: In LockettePro's plugin.yml, one of those change will work: (sorry I don't know which one should work, and I cannot check it personally right now).

  1. Add S** to the list of softdepend or
  2. Add this line: loadbefore: [S*******]
k-jiang commented 7 years ago

It seems that loadbefore works. Anyway I'm adding both of them into plugin.yml just for sure. No, only use one of them... softdepend actually means loadafter.

connection-lost commented 7 years ago

Fixed in later versions