Only leave inventory untouched if registration is not enforced

This commit is contained in:
games647 2021-06-19 11:46:12 +02:00
parent 25f7e1321a
commit a8ebe70900
No known key found for this signature in database
GPG Key ID: BFC68C8708713A88
2 changed files with 17 additions and 8 deletions

View File

@ -24,20 +24,22 @@ import com.comphenix.protocol.events.PacketAdapter;
import com.comphenix.protocol.events.PacketContainer;
import com.comphenix.protocol.events.PacketEvent;
import com.comphenix.protocol.reflect.StructureModifier;
import fr.xephi.authme.AuthMe;
import fr.xephi.authme.ConsoleLogger;
import fr.xephi.authme.data.auth.PlayerCache;
import fr.xephi.authme.datasource.DataSource;
import fr.xephi.authme.output.ConsoleLoggerFactory;
import fr.xephi.authme.service.BukkitService;
import org.bukkit.Material;
import org.bukkit.entity.Player;
import org.bukkit.inventory.ItemStack;
import java.lang.reflect.InvocationTargetException;
import java.util.Arrays;
import java.util.List;
import org.bukkit.Material;
import org.bukkit.entity.Player;
import org.bukkit.inventory.ItemStack;
class InventoryPacketAdapter extends PacketAdapter {
private static final int PLAYER_INVENTORY = 0;
@ -52,10 +54,14 @@ class InventoryPacketAdapter extends PacketAdapter {
private final PlayerCache playerCache;
private final DataSource dataSource;
InventoryPacketAdapter(AuthMe plugin, PlayerCache playerCache, DataSource dataSource) {
private final boolean isRegistrationForced;
InventoryPacketAdapter(AuthMe plugin, PlayerCache playerCache, DataSource dataSource,
boolean isRegistrationForced) {
super(plugin, PacketType.Play.Server.SET_SLOT, PacketType.Play.Server.WINDOW_ITEMS);
this.playerCache = playerCache;
this.dataSource = dataSource;
this.isRegistrationForced = isRegistrationForced;
}
@Override
@ -94,9 +100,9 @@ class InventoryPacketAdapter extends PacketAdapter {
}
// data source is not cached - this means queries would run blocking
// Assume the player is registered would mean the inventory will be protected
// and any potential information leak can be prevented
return true;
// If registration is enforced: **assume** player is registered to prevent any information leak
// If not, players could play even without a registration, so there is no need for protection
return isRegistrationForced;
}
public void unregister() {

View File

@ -9,6 +9,7 @@ import fr.xephi.authme.initialization.SettingsDependent;
import fr.xephi.authme.output.ConsoleLoggerFactory;
import fr.xephi.authme.service.BukkitService;
import fr.xephi.authme.settings.Settings;
import fr.xephi.authme.settings.properties.RegistrationSettings;
import fr.xephi.authme.settings.properties.RestrictionSettings;
import org.bukkit.entity.Player;
@ -26,6 +27,7 @@ public class ProtocolLibService implements SettingsDependent {
/* Settings */
private boolean protectInvBeforeLogin;
private boolean denyTabCompleteBeforeLogin;
private boolean isRegistrationForced;
/* Service */
private boolean isEnabled;
@ -66,7 +68,7 @@ public class ProtocolLibService implements SettingsDependent {
if (protectInvBeforeLogin) {
if (inventoryPacketAdapter == null) {
// register the packet listener and start hiding it for all already online players (reload)
inventoryPacketAdapter = new InventoryPacketAdapter(plugin, playerCache, dataSource);
inventoryPacketAdapter = new InventoryPacketAdapter(plugin, playerCache, dataSource, isRegistrationForced);
inventoryPacketAdapter.register(bukkitService);
}
} else if (inventoryPacketAdapter != null) {
@ -120,6 +122,7 @@ public class ProtocolLibService implements SettingsDependent {
this.protectInvBeforeLogin = settings.getProperty(RestrictionSettings.PROTECT_INVENTORY_BEFORE_LOGIN);
this.denyTabCompleteBeforeLogin = settings.getProperty(RestrictionSettings.DENY_TABCOMPLETE_BEFORE_LOGIN);
this.isRegistrationForced = settings.getProperty(RegistrationSettings.FORCE);
//it was true and will be deactivated now, so we need to restore the inventory for every player
if (oldProtectInventory && !protectInvBeforeLogin && inventoryPacketAdapter != null) {