Essentials icon indicating copy to clipboard operation
Essentials copied to clipboard

Fix tpaccept world teleport permissions

Open mind04 opened this issue 4 years ago • 0 comments

Details

Fix a world teleport permission bypass. A user with permission for a word is able to provide access to that world to users without permission.

Environments tested:

OS: Debian 10

Java version: 17

  • [x] Most recent Paper version (1.XX.Y, git-Paper-BUILD)
  • [ ] CraftBukkit/Spigot/Paper 1.12.2
  • [ ] CraftBukkit 1.8.8

Demonstration: user1 has permission to world X user2 has no permission to world X

With use of tpahere: user1 goes to world X and executes /tpahere user2 executes /tpaccept -> tp of user2 to world X

With use of tpa: Both users are in the same world. user2 executes /tpa user1 user1 teleports to word X user1 executes /tpaccept -> tp of user2 to world X

mind04 avatar Jan 02 '22 23:01 mind04