Add disguise limiters for non-admins & safeguards

Give admins or people who should be able to disguise as a player fully the permission `plex.libsdisguises.player`

Also updated repos and LibsDisguises version

build.gradle.kts

@@ -12,6 +12,14 @@ repositories {
         url = uri("https://nexus.telesphoreo.me/repository/plex/")
     }
 
+    maven {
+        url = uri("https://repo.md-5.net/content/groups/public")
+    }
+
+    maven {
+        url = uri("https://repo.dmulloy2.net/repository/public/")
+    }
+
     mavenCentral()
 }
 
@@ -20,7 +28,7 @@ dependencies {
     annotationProcessor("org.projectlombok:lombok:1.18.28")
     compileOnly("io.papermc.paper:paper-api:1.20.1-R0.1-SNAPSHOT")
     compileOnly("dev.plex:server:1.3")
-    implementation("LibsDisguises:LibsDisguises:10.0.28")
+    implementation("LibsDisguises:LibsDisguises:10.0.37")
 }
 
 group = "dev.plex"

src/main/java/dev/plex/listener/DisguiseListener.java

@@ -7,8 +7,14 @@ import dev.plex.util.PlexLog;
 import java.util.ArrayList;
 import java.util.List;
 import me.libraryaddict.disguise.DisguiseAPI;
+import me.libraryaddict.disguise.disguisetypes.DisguiseType;
+import me.libraryaddict.disguise.disguisetypes.PlayerDisguise;
+import me.libraryaddict.disguise.disguisetypes.watchers.*;
+import me.libraryaddict.disguise.events.DisguiseEvent;
 import net.kyori.adventure.text.Component;
 import net.kyori.adventure.text.format.NamedTextColor;
+import net.kyori.adventure.text.serializer.legacy.LegacyComponentSerializer;
+import net.kyori.adventure.text.serializer.plain.PlainTextComponentSerializer;
 import org.bukkit.Bukkit;
 import org.bukkit.command.Command;
 import org.bukkit.command.PluginCommandYamlParser;
@@ -20,6 +26,78 @@ import org.bukkit.plugin.Plugin;
 
 public class DisguiseListener extends PlexListener
 {
+    private static float safeYMod(float f)
+    {
+        return Math.max(-256f, Math.min(256f, f));
+    }
+
+    @EventHandler
+    public void onDisguiseEvent(DisguiseEvent event)
+    {
+        event.setCancelled(true);
+        PlexPlayer plexPlayer = null;
+        if (event.getCommandSender() instanceof Player player) plexPlayer = DataUtils.getPlayer(player.getUniqueId());
+        boolean ranksAndNotAdmin = plexPlayer != null && plugin.getSystem().equalsIgnoreCase("ranks") && !plugin.getRankManager().isAdmin(plexPlayer);
+        if (ranksAndNotAdmin && event.getDisguise().getType() == DisguiseType.FISHING_HOOK)
+        {
+            event.getCommandSender().sendMessage(Component.text("You cannot use Fishing Hook disguises").color(NamedTextColor.RED));
+            return;
+        }
+        String name = event.getDisguise().getWatcher().getCustomName();
+        if (name != null)
+        {
+            int noColorLen = PlainTextComponentSerializer.plainText().serialize(LegacyComponentSerializer.legacySection().deserialize(name)).length();
+            // each color code counts as one char rather than two, for flexibility
+            if (((name.length() - noColorLen) / 2) + noColorLen > 32)
+            {
+                event.getCommandSender().sendMessage(Component.text("Your disguise name is too long").color(NamedTextColor.RED));
+                return;
+            }
+        }
+        if (event.getDisguise().getWatcher() instanceof EnderDragonWatcher watcher && watcher.getPhase() == 7) watcher.setPhase(6);
+        if (event.getDisguise().getWatcher() instanceof WitherWatcher watcher && watcher.getInvulnerability() > 2048) watcher.setInvulnerability(2048);
+        if (event.getDisguise().isPlayerDisguise() && plexPlayer != null && (ranksAndNotAdmin || (plugin.getSystem().equalsIgnoreCase("permissions") && !plexPlayer.getPlayer().hasPermission("plex.libsdisguises.player"))))
+        {
+            PlayerDisguise playerDisguise = (PlayerDisguise) event.getDisguise();
+            String targetName = playerDisguise.getName();
+            String origName = event.getDisguised().getName();
+            playerDisguise.setName(origName);
+            playerDisguise.setNameVisible(true);
+            playerDisguise.getWatcher().setNameYModifier(0);
+            playerDisguise.setSkin(targetName);
+            playerDisguise.setDisplayedInTab(false);
+            playerDisguise.setTablistName(origName);
+        }
+        if (ranksAndNotAdmin && event.getDisguise().isHidePlayer()) event.getDisguise().setHidePlayer(false);
+        if (event.getDisguise().getWatcher() instanceof AreaEffectCloudWatcher watcher)
+        {
+            if (watcher.getRadius() > 5)
+            {
+                watcher.setRadius(5);
+            }
+            else if (watcher.getRadius() < 0)
+            {
+                watcher.setRadius(0);
+            }
+        }
+        event.getDisguise().getWatcher().setNameYModifier(safeYMod(event.getDisguise().getWatcher().getNameYModifier()));
+        event.getDisguise().getWatcher().setYModifier(safeYMod(event.getDisguise().getWatcher().getYModifier()));
+        if (event.getDisguise().getWatcher() instanceof SlimeWatcher watcher && watcher.getSize() > 10)
+            watcher.setSize(10);
+        if (event.getDisguise().getWatcher() instanceof PhantomWatcher watcher)
+        {
+            if (watcher.getSize() > 20)
+            {
+                watcher.setSize(20);
+            }
+            else if (watcher.getSize() < -36)
+            {
+                watcher.setSize(-36);
+            }
+        }
+        event.setCancelled(false);
+    }
+
     final List<Command> commands = new ArrayList<>();
 
     @EventHandler