Essentials
Essentials copied to clipboard
Fix tpaccept world teleport permissions
Details
Fix a world teleport permission bypass. A user with permission for a word is able to provide access to that world to users without permission.
Environments tested:
OS: Debian 10
Java version: 17
- [x] Most recent Paper version (1.XX.Y, git-Paper-BUILD)
- [ ] CraftBukkit/Spigot/Paper 1.12.2
- [ ] CraftBukkit 1.8.8
Demonstration: user1 has permission to world X user2 has no permission to world X
With use of tpahere: user1 goes to world X and executes /tpahere user2 executes /tpaccept -> tp of user2 to world X
With use of tpa: Both users are in the same world. user2 executes /tpa user1 user1 teleports to word X user1 executes /tpaccept -> tp of user2 to world X