[BUG] Enderchest Duplication Error

Ste3et commented 1 year ago

Is there an existing issue for this?

[X] I have searched the existing issues

Type of bug

Exploit, Compatibility issue

Environment

- Server Version: Paper Spigot 1.19.3 #338 - 1.19.2 #307
- Shop Version: 1.8.4.x

Server startup log

https://pastebin.com/pXP4qCdF

Shop config files

https://pastebin.com/qsiLaAU4

Error log (if applicable)

No response

Bug description

You can overrite your enderchest content with the opening of an offline player enderchest. I use the plugin https://www.spigotmc.org/resources/cmi-298-commands-insane-kits-portals-essentials-economy-mysql-sqlite-much-more.3742/ with that i can open offline player enderchests, with the activated enderchest shop feature my personal enderchest will be overriden with the content of the offlineplayer enderchest.

Steps to reproduce

1.) Player A use /cmi ender (offlinePlayer) 2.) Player A go offline 3.) Player A login again to the server 4.) Player A open enderchest via block. 5.) Player A have now the enderchest content from the offlinePlayer

Expected behaviour

That you can't duplicate your enderchest from another user.

Actual behaviour

Your own Enderchest content will be overriden by another OfflinePlayer Enderchest Content.

Other information

If you disable the ENDER_CHEST support from the Shop Plugin everthing works great, i don't know why these feature was enabled.

snowgears commented 1 year ago

I will look into this, thanks for the report!

snowgears commented 1 year ago

Looks more like an integration request with CMI, rather than a bug. CMI appears to just replicate an offline players enderchest and save as your own temperarily, and shop takes this "fake" inventory and saves it as your own when closing it.

snowgears commented 1 year ago

Fixed in 1.8.4.2 (in progress)

I am no longer saving ender chest inventories to a file and have switched to a new system where I load player DAT files and interact directly with NBT for offline enderchests.

snowgears / shopbugs