Upstream
/
bentobox
mirror of https://github.com/BentoBoxWorld/BentoBox.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fixes an issue with missing parent permission check before command execution. 

Implement a new method that recursively checks if player has access permission to all commands in whole hierarchy.

Fixes #2010
This commit is contained in:
BONNe 2022-08-03 19:00:42 +03:00
parent 64b4c43742
commit 44201afa1f
1 changed files with 30 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
src/main/java/world/bentobox/bentobox/api/commands/CompositeCommand.java
View File

@ -262,17 +262,44 @@ public abstract class CompositeCommand extends Command implements PluginIdentifi
user.sendMessage("general.errors.use-in-game");
return false;
}
// Check perms, but only if this isn't the console
if (user.isPlayer() && !user.isOp() && getPermission() != null && !getPermission().isEmpty() && !user.hasPermission(getPermission())) {
user.sendMessage("general.errors.no-permission", TextVariables.PERMISSION, getPermission());
if (!this.runPermissionCheck(user))
{
// Error message is displayed by permission check.
return false;
}
// Set the user's addon context
user.setAddon(addon);
// Execute and trim args
return canExecute(user, cmdLabel, cmdArgs) && execute(user, cmdLabel, cmdArgs);
}
/**
* This method checks and returns if user has access to the called command.
* It also recursively checks if user has access to the all parent commands.
* @param user User who permission must be checked.
* @return {@code true} is user can execute given command, {@code false} otherwise.
*/
private boolean runPermissionCheck(User user)
{
// Check perms, but only if this isn't the console
if (user.isPlayer() &&
!user.isOp() &&
this.getPermission() != null &&
!this.getPermission().isEmpty() &&
!user.hasPermission(this.getPermission()))
{
user.sendMessage("general.errors.no-permission", TextVariables.PERMISSION, this.getPermission());
return false;
}
// Recursive permission check to find if user has access to the parent command.
return this.getParent() == null || this.getParent().runPermissionCheck(user);
}
/**
* Get the current composite command based on the arguments
* @param args - arguments