From d54325304e8b1dd969ff702315b0014bb97781dd Mon Sep 17 00:00:00 2001 From: Video Date: Wed, 23 Aug 2023 14:23:30 -0600 Subject: [PATCH] Fixes vulnerability related to command blocking in rank-based systems (#58) Video contributing to Plex finally??? --- .../src/main/java/dev/plex/listener/impl/CommandListener.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/server/src/main/java/dev/plex/listener/impl/CommandListener.java b/server/src/main/java/dev/plex/listener/impl/CommandListener.java index 1f3989c..3f78dbb 100644 --- a/server/src/main/java/dev/plex/listener/impl/CommandListener.java +++ b/server/src/main/java/dev/plex/listener/impl/CommandListener.java @@ -1,5 +1,6 @@ package dev.plex.listener.impl; +import dev.plex.Plex; import dev.plex.cache.DataUtils; import dev.plex.command.blocking.BlockedCommand; import dev.plex.listener.PlexListener; @@ -46,7 +47,7 @@ public class CommandListener extends PlexListener { String command = "/" + event.getMessage().replaceFirst("/", "").trim(); Player player = event.getPlayer(); - if (player.hasPermission("plex.commandblocker.bypass")) return; + if (Plex.get().getPermissions() != null && Plex.get().getPermissions().has(player, "plex.commandblocker.bypass")) return; PlexPlayer plexPlayer = DataUtils.getPlayer(player.getUniqueId()); String commandName = StringUtils.normalizeSpace(command).split(" ")[0].replaceFirst("/", ""); String arguments = StringUtils.normalizeSpace(StringUtils.normalizeSpace(command).replace(command.split(" ")[0], ""));