Upstream/bentobox
1
0
Fork 0
mirror of https://github.com/BentoBoxWorld/BentoBox.git synced 2025-02-03 22:11:32 +01:00
Code Issues Projects Releases Wiki Activity

Fixes an issue with missing parent permission check before command execution.

Browse Source 
Implement a new method that recursively checks if player has access permission to all commands in whole hierarchy.

Fixes #2010
This commit is contained in:
BONNe 2022-08-03 19:00:42 +03:00
parent 64b4c43742
commit 44201afa1f
1 changed files with 30 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
src/main/java/world/bentobox/bentobox/api/commands/CompositeCommand.java
View File

@ -262,17 +262,44 @@ public abstract class CompositeCommand extends Command implements PluginIdentifi
user.sendMessage("general.errors.use-in-game"); user.sendMessage("general.errors.use-in-game");
return false; return false;
} }
// Check perms, but only if this isn't the console
if (user.isPlayer() && !user.isOp() && getPermission() != null && !getPermission().isEmpty() && !user.hasPermission(getPermission())) { if (!this.runPermissionCheck(user))
user.sendMessage("general.errors.no-permission", TextVariables.PERMISSION, getPermission()); {
// Error message is displayed by permission check.
return false; return false;
} }
// Set the user's addon context // Set the user's addon context
user.setAddon(addon); user.setAddon(addon);
// Execute and trim args // Execute and trim args
return canExecute(user, cmdLabel, cmdArgs) && execute(user, cmdLabel, cmdArgs); return canExecute(user, cmdLabel, cmdArgs) && execute(user, cmdLabel, cmdArgs);
} }
/**
* This method checks and returns if user has access to the called command.
* It also recursively checks if user has access to the all parent commands.
* @param user User who permission must be checked.
* @return {@code true} is user can execute given command, {@code false} otherwise.
*/
private boolean runPermissionCheck(User user)
{
// Check perms, but only if this isn't the console
if (user.isPlayer() &&
!user.isOp() &&
this.getPermission() != null &&
!this.getPermission().isEmpty() &&
!user.hasPermission(this.getPermission()))
{
user.sendMessage("general.errors.no-permission", TextVariables.PERMISSION, this.getPermission());
return false;
}
// Recursive permission check to find if user has access to the parent command.
return this.getParent() == null || this.getParent().runPermissionCheck(user);
}
/** /**
* Get the current composite command based on the arguments * Get the current composite command based on the arguments
* @param args - arguments * @param args - arguments