From 51ff043af98a511293017462dbba4c14babffed5 Mon Sep 17 00:00:00 2001
From: dordsor21 <dordsor21@gmail.com>
Date: Thu, 22 Jul 2021 21:45:51 +0100
Subject: [PATCH] Prevent users defining their own click events in
 descriptions/farewells/greetings by default

---
 .../com/plotsquared/core/configuration/Settings.java   |  5 +++++
 .../com/plotsquared/core/listener/PlotListener.java    | 10 ++++++++--
 Core/src/main/java/com/plotsquared/core/plot/Plot.java |  3 +++
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/Core/src/main/java/com/plotsquared/core/configuration/Settings.java b/Core/src/main/java/com/plotsquared/core/configuration/Settings.java
index 8d4ac9b48..7167d990d 100644
--- a/Core/src/main/java/com/plotsquared/core/configuration/Settings.java
+++ b/Core/src/main/java/com/plotsquared/core/configuration/Settings.java
@@ -498,6 +498,11 @@ public class Settings extends Config {
                 "notify-enter, notify-leave, greeting or farewell flag."})
         public static boolean NOTIFICATION_AS_ACTIONBAR = false;
 
+        @Comment({"Whether to strip any possible <click_event> components from user-defined messages, e.g. plot greeting",
+                "This can allow players to use commands to give themselves ranks as commands ran in this fashion cannot be prevent by " +
+                        "permissions etc."})
+        public static boolean REMOVE_USER_DEFINED_CLICK_EVENTS = true;
+
     }
 
 
diff --git a/Core/src/main/java/com/plotsquared/core/listener/PlotListener.java b/Core/src/main/java/com/plotsquared/core/listener/PlotListener.java
index 19b378ce1..8e0d5719b 100644
--- a/Core/src/main/java/com/plotsquared/core/listener/PlotListener.java
+++ b/Core/src/main/java/com/plotsquared/core/listener/PlotListener.java
@@ -169,8 +169,11 @@ public class PlotListener {
                 titles = titleFlag == TitlesFlag.TitlesFlagValue.TRUE;
             }
 
-            final String greeting = plot.getFlag(GreetingFlag.class);
+            String greeting = plot.getFlag(GreetingFlag.class);
             if (!greeting.isEmpty()) {
+                if (Settings.Chat.REMOVE_USER_DEFINED_CLICK_EVENTS) {
+                    greeting = greeting.replaceAll(".([c-lC-L]{5}):([a-uA-U_]{11}):[^\\/]*[^>]*>>", "").replace("</click>", "");
+                }
                 if (!Settings.Chat.NOTIFICATION_AS_ACTIONBAR) {
                     plot.format(StaticCaption.of(greeting), player, false).thenAcceptAsync(player::sendMessage);
                 } else {
@@ -390,8 +393,11 @@ public class PlotListener {
                     }
                 }
 
-                final String farewell = plot.getFlag(FarewellFlag.class);
+                String farewell = plot.getFlag(FarewellFlag.class);
                 if (!farewell.isEmpty()) {
+                    if (Settings.Chat.REMOVE_USER_DEFINED_CLICK_EVENTS) {
+                        farewell = farewell.replaceAll(".([c-lC-L]{5}):([a-uA-U_]{11}):[^\\/]*[^>]*>", "").replace("</click>", "");
+                    }
                     if (!Settings.Chat.NOTIFICATION_AS_ACTIONBAR) {
                         plot.format(StaticCaption.of(farewell), player, false).thenAcceptAsync(player::sendMessage);
                     } else {
diff --git a/Core/src/main/java/com/plotsquared/core/plot/Plot.java b/Core/src/main/java/com/plotsquared/core/plot/Plot.java
index f6b840118..e039b6cad 100644
--- a/Core/src/main/java/com/plotsquared/core/plot/Plot.java
+++ b/Core/src/main/java/com/plotsquared/core/plot/Plot.java
@@ -2785,6 +2785,9 @@ public class Plot {
                     String description = this.getFlag(DescriptionFlag.class);
                     if (description.isEmpty()) {
                         description = TranslatableCaption.of("info.plot_no_description").getComponent(player);
+                    } else if (Settings.Chat.REMOVE_USER_DEFINED_CLICK_EVENTS) {
+                        description = description.replaceAll(".([c-lC-L]{5}):([a-uA-U_]{11}):[^\\/]*[^>]*>", "").replace("</click>",
+                                "");
                     }
 
                     Component flags;