search

sakurawald / fuji

A mod that ports EssentialsX / CMI from bukkit to fabric.
GNU General Public License v3.0
37 stars 5 forks source link

Fuji allows commands to be run by folks who have no permission nodes #156

Closed payphone101 closed 1 week ago

payphone101 commented 1 week ago

How to Reproduce the bug?

  1. Install Fuji
  2. Enable permissions module
  3. Put a couple permissions on a certain group

What is the expected behavior?

Only the group with the permission should be able to use the commands and deny everyone else

What is the actual behavior?

Anyone could use the commands unless you give them negative permissions

Please upload the server logs using https://mclo.gs/ Yes, my logs link is:

https://mclo.gs/lHCRs2k

sakurawald commented 1 week ago

Hello, can you issue the /lp group default permission info to list the permissions assigned to the default group ? And also issue the command /lp group <the-folks-group> permission info to list the permissions assigned to the <folks-group>.

sakurawald commented 1 week ago

Hello, I have read the logs. By default, the functional commands like /workbench and /enderchest requires level 0 to use (These commands requires level 0 to use, since they are not considered as harmful) . And some commands like /fly, /god, /more requires level 4 to use.

Also, you can use a non-op account to see what the default requirement of each commands.

In the latest version of fuji, you can issue the /fuji inspect fuji-commands to see the default requirement.

sakurawald commented 1 week ago

By the way, you can disable the console spam like

    [16:40:45] [Server thread/ERROR]: CommandExecuter fails to execute commands.
com.mojang.brigadier.exceptions.CommandSyntaxException: Expected integer at position 25: ...Mizenquif <--[HERE]

I have reply this in https://github.com/sakurawald/fuji/issues/146#issuecomment-2398219282

payphone101 commented 1 week ago

Hello, can you issue the /lp group default permission info to list the permissions assigned to the default group ? And also issue the command /lp group <the-folks-group> permission info to list the permissions assigned to the <folks-group>.

image ^ above is the only permissions the default group has but for some reason they can use stuff like workbench, stonecutter, enderchest, etc. Would be nice if they do not need a negative permission by default to be denied access to those

sakurawald commented 1 week ago

Hello, can you issue the /lp group default permission info to list the permissions assigned to the default group ? And also issue the command /lp group <the-folks-group> permission info to list the permissions assigned to the <folks-group>.

image ^ above is the only permissions the default group has but for some reason they can use stuff like workbench, stonecutter, enderchest, etc. Would be nice if they do not need a negative permission by default to be denied access to those

Let me explain this:

  1. The command /fly and /god provided by fuji required level 4 to use, so here it is not necessary to assign a negative permission for them. If you want to allow a user group to use these commands, you can just assign a positive permission to the specific user group. (If there is no a positive/negative permission assigned for default group, then it will fallback to the original requimenet predicate, here the predicate is requires level 4.
  2. The command /home provided by fuji requires level 0 to use, so it's also un-necessary to assign a positive permission for the folks user. (By the way, you can use /lp group default permission set fuji.permission.home.* to assign a wildcard permission, this is a feature provided by luckperms. Also be careful the usage of wildcard, more details can be read in luckperms wiki.)
  3. The command /me provided by vanilla minecraft requires level 0 to use, it's okay to ban this command via a negative permission.
sakurawald commented 1 week ago

The reason they can use /workbench and /enderchest is that, all commands provided by functional module requires level 0 to use them by default. So this is not a bug about the command permission module, you can use command permission module to override the original requirement of these commands, by assigning a negative permission to dis-allow the usage of them.

The default permission requirement should also be configurable, it will be considered as a feature in future version.

sakurawald commented 1 week ago

This feature is added since fuji v2.0.0