diff --git a/src/main/java/com/onarandombox/MultiverseCore/commands/CreateCommand.java b/src/main/java/com/onarandombox/MultiverseCore/commands/CreateCommand.java index 87bdacab..6d8f3833 100644 --- a/src/main/java/com/onarandombox/MultiverseCore/commands/CreateCommand.java +++ b/src/main/java/com/onarandombox/MultiverseCore/commands/CreateCommand.java @@ -46,10 +46,15 @@ public class CreateCommand extends MultiverseCommand { this.addCommandExample("/mv create " + ChatColor.GOLD + "moonworld" + ChatColor.GREEN + " normal" + ChatColor.DARK_AQUA + " -g BukkitFullOfMoon"); this.worldManager = this.plugin.getMVWorldManager(); } - + + private String trimWorldName(String userInput) { + // Removes relative paths. + return userInput.replaceAll("^[./\\\\]+", ""); + } + @Override public void runCommand(CommandSender sender, List args) { - String worldName = args.get(0); + String worldName = trimWorldName(args.get(0)); File worldFile = new File(this.plugin.getServer().getWorldContainer(), worldName); String env = args.get(1); String seed = CommandHandler.getFlag("-s", args); @@ -66,7 +71,13 @@ public class CreateCommand extends MultiverseCommand { useSpawnAdjust = false; } } - + + // Make sure the world name doesn't contain the words 'plugins' and '.dat' + if(worldName.contains("plugins")||worldName.contains(".dat")){ + sender.sendMessage(ChatColor.RED + "Multiverse cannot create a world that contains 'plugins' or '.dat'"); + return; + } + if (this.worldManager.isMVWorld(worldName)) { sender.sendMessage(ChatColor.RED + "Multiverse cannot create " + ChatColor.GOLD + ChatColor.UNDERLINE + "another" + ChatColor.RESET + ChatColor.RED + " world named " + worldName); @@ -117,4 +128,4 @@ public class CreateCommand extends MultiverseCommand { Command.broadcastCommandMessage(sender, "FAILED."); } } -} +} \ No newline at end of file diff --git a/src/main/java/com/onarandombox/MultiverseCore/commands/ImportCommand.java b/src/main/java/com/onarandombox/MultiverseCore/commands/ImportCommand.java index d808e0b1..7a52d5a1 100644 --- a/src/main/java/com/onarandombox/MultiverseCore/commands/ImportCommand.java +++ b/src/main/java/com/onarandombox/MultiverseCore/commands/ImportCommand.java @@ -81,6 +81,12 @@ public class ImportCommand extends MultiverseCommand { this.showHelp(sender); return; } + + // Make sure the world name doesn't contain the words 'plugins' and '.dat' + if(worldName.contains("plugins")||worldName.contains(".dat")){ + sender.sendMessage(ChatColor.RED + "Multiverse cannot create a world that contains 'plugins' or '.dat'"); + return; + } // Make sure we don't already know about this world. if (this.worldManager.isMVWorld(worldName)) { @@ -128,4 +134,4 @@ public class ImportCommand extends MultiverseCommand { Command.broadcastCommandMessage(sender, ChatColor.RED + "Failed!"); } } -} +} \ No newline at end of file