mirror of
https://github.com/Multiverse/Multiverse-Core.git
synced 2024-09-25 13:52:41 +02:00
Fix creation and import Exploit (#2353)
Through this fix you can avoid deleting of important folders.
This commit is contained in:
parent
28cee291c6
commit
f72cc6764b
@ -47,9 +47,14 @@ public class CreateCommand extends MultiverseCommand {
|
|||||||
this.worldManager = this.plugin.getMVWorldManager();
|
this.worldManager = this.plugin.getMVWorldManager();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
private String trimWorldName(String userInput) {
|
||||||
|
// Removes relative paths.
|
||||||
|
return userInput.replaceAll("^[./\\\\]+", "");
|
||||||
|
}
|
||||||
|
|
||||||
@Override
|
@Override
|
||||||
public void runCommand(CommandSender sender, List<String> args) {
|
public void runCommand(CommandSender sender, List<String> args) {
|
||||||
String worldName = args.get(0);
|
String worldName = trimWorldName(args.get(0));
|
||||||
File worldFile = new File(this.plugin.getServer().getWorldContainer(), worldName);
|
File worldFile = new File(this.plugin.getServer().getWorldContainer(), worldName);
|
||||||
String env = args.get(1);
|
String env = args.get(1);
|
||||||
String seed = CommandHandler.getFlag("-s", args);
|
String seed = CommandHandler.getFlag("-s", args);
|
||||||
@ -67,6 +72,12 @@ public class CreateCommand extends MultiverseCommand {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// Make sure the world name doesn't contain the words 'plugins' and '.dat'
|
||||||
|
if(worldName.contains("plugins")||worldName.contains(".dat")){
|
||||||
|
sender.sendMessage(ChatColor.RED + "Multiverse cannot create a world that contains 'plugins' or '.dat'");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
if (this.worldManager.isMVWorld(worldName)) {
|
if (this.worldManager.isMVWorld(worldName)) {
|
||||||
sender.sendMessage(ChatColor.RED + "Multiverse cannot create " + ChatColor.GOLD + ChatColor.UNDERLINE
|
sender.sendMessage(ChatColor.RED + "Multiverse cannot create " + ChatColor.GOLD + ChatColor.UNDERLINE
|
||||||
+ "another" + ChatColor.RESET + ChatColor.RED + " world named " + worldName);
|
+ "another" + ChatColor.RESET + ChatColor.RED + " world named " + worldName);
|
||||||
|
@ -82,6 +82,12 @@ public class ImportCommand extends MultiverseCommand {
|
|||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// Make sure the world name doesn't contain the words 'plugins' and '.dat'
|
||||||
|
if(worldName.contains("plugins")||worldName.contains(".dat")){
|
||||||
|
sender.sendMessage(ChatColor.RED + "Multiverse cannot create a world that contains 'plugins' or '.dat'");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
// Make sure we don't already know about this world.
|
// Make sure we don't already know about this world.
|
||||||
if (this.worldManager.isMVWorld(worldName)) {
|
if (this.worldManager.isMVWorld(worldName)) {
|
||||||
sender.sendMessage(ChatColor.GREEN + "Multiverse" + ChatColor.WHITE
|
sender.sendMessage(ChatColor.GREEN + "Multiverse" + ChatColor.WHITE
|
||||||
|
Loading…
Reference in New Issue
Block a user