At line 210 of backend/websockets/chat.js, /uptime is listed as an operator-only command. However unlike other restricted commands like /worlds and /channel, there are no checks for the operator status of the user. At the command type switch statement, com.uptime is called with no checks. I'm unsure as if this command is meant to be private or not, as while it does give the average user access to mildly sensitive data, most users would not know how to use it maliciously (if possible).
At line 210 of backend/websockets/chat.js, /uptime is listed as an operator-only command. However unlike other restricted commands like /worlds and /channel, there are no checks for the operator status of the user. At the command type switch statement, com.uptime is called with no checks. I'm unsure as if this command is meant to be private or not, as while it does give the average user access to mildly sensitive data, most users would not know how to use it maliciously (if possible).