webbukkit / dynmap

A set of Minecraft mods that provide a real time web-based map system for various Minecraft server implementations.
https://www.reddit.com/r/Dynmap/
Apache License 2.0
2.05k stars 419 forks source link

Setting "webchat-requires-login" to true does not prevent chat spying #3688

Open paul-eff opened 2 years ago

paul-eff commented 2 years ago

Issue Description: I can prevent unauthorized users from using the web chat component (requiring them to login and create an account with the webregister command). But from what I can see this does not prevent said unauthorized users from seeing the ingame chat.

Basically I would assume "webchat-requires-login" disables all web chatting (also receiving messages) but it only prevents unauthorized users to chat, not from seeing the chat. I am aware that I can disable all chat receiving capabilities (in the web) by disabling "org.dynmap.SimpleWebChatComponent.allowchat", but this then also applies to logged-in users.

mikeprimm commented 2 years ago

webchat-requires-login is intended to control ability of web to contribute to chat, not to see chat. This is works as designed.

I'll look into adding an option to limit chat read to login, but it'll be some work, as chat event reporting is via the same mechanism as tile, marker, map and world updates.