sekwah41
commented
2 years ago The force op is related to being able to run the commands as op. To be able to create these you already need to be op as well as they can be disabled through the config.
We tried to have this disabled by default however sadly a LOT of users were confused on how to enable it or saying the plugin was "broken" so we got a lot of bad reviews because we tried to keep users secure and safe from rogue admins.
The problem is the only way from what I can tell to temp set someone is op for the duration of a command or at least the command call phase which due to the nature of how mc executes its not really possible to abuse this in a weird way unless you force crash the server, and at that point the server wont have even written the op settings to any user data.
There was a suggestion from one of the people from this anti-malware (possibly a different one) plugin and their suggestion was to make some proxy user, which in practice isnt possible due to the fact the reason people want to run the commands this way is it needs to affect the user sending the command. As well as the suggested method they came up with you would theoretically have to make a compatibility layer for every version of craftbukkit you plan to support as well as you would have a tonne of side effects on top of that adding to both an unrealistic maintainability effort as well as other problems.
If anyone is aware of another way to run commands with elevated permissions feel free to comment or show an example however from checking other plugins such as command signs this seems to be the common way to do this.
Link0Darck
Strahilchu
github-actions[bot]
Good morning, the AntiMalware has detected a force op command in your plugin which is vulnerable if you don't check by yourself with the spigot staff plugin plugin : (https://www.spigotmc.org/resources/spigot-anti-malware.64982/) `[AntiMalware] [00:30:13] [INFO]: Using locale en
[AntiMalware] [00:30:13] [INFO]: Any bugs and/or false-positives should be reported either on the GitHub repo, plugin discussion page, or on the discord server [AntiMalware] [00:30:13] [INFO]: Registering checks [AntiMalware] [00:30:13] [INFO]: Finished registering checks [AntiMalware] [00:30:13] [INFO]: Setting up the Auto-Updater [AntiMalware] [00:30:13] [INFO]: Finished initializing [AntiMalware] [00:30:13] [DETECTED]: plugins\Advanced-Portals-0.0.41-snapshot.jar MIGHT be infected with Spigot.MALWARE.ForceOP.A Class Path: com/sekwah/advancedportals/portals/Portal ; SourceFile/Line Portal.java/463 Remaining files to scan: 0`