Partydragen
Partydragen
Owner

534 posts
Minecraft: Partydragen
Partydragen: Partydragen
Discord: partydragen
Minecraft-Community: Partydragen
By Partydragen » over 6 years ago
@everyone Security Warning!!
CreateYourOwnMenus plugin have a major security issues! If you give your players Gamemode, Or have a Creative world people can abuse this security to force-op them self and take full control of your server

People who abuse this bug will be logged to our systems and will be permanely banned!



Last edited: over 6 years ago
Owner of CubedCraft Network
Server Ip: mc.cubedcraft.com
My Website:
 http://partydragen.com/
AmazinglyJava
AmazinglyJava
Member

190 posts
Minecraft: AmazinglyJava
Discord: Unknown
By AmazinglyJava » over 6 years ago
 
How to know if you are safe or not

If you have a regular creative server without CreateYourOwnMenus installed you are fine.

If you have creative server with CreateYourOwnMenus installed then players can force op. Even if it's not used, or players don't have access to any menu you are still at risk.

If you have a survival server (or any gamemode that players do not have creative) with CreateYourOwnMenus installed, then you are fine.

I suggest you don't give players creative for 'Build Tests' or other stuff if you have CreateYourOwnMenus installed.

If CreateYourOwnMenus is not installed then you are completely fine, don't worry about this. :)





I'm a developer! Message me if you need help!<br /> <br /> Put "@Partydragen is a noob" in discord!
KyanG7
KyanG7
God

120 posts
Minecraft: KyanG7
Discord: Unknown
By KyanG7 » over 6 years ago
I have found a few fixes to this bug as I was the one who reported it and tested it with the permission of AmazinglyJava, EnderAdamGaming and I did test it on partydragen's PS to test it. If anyone wants a little bit of help patching it I would love to help as a temporary small fix until its actually fixed.

DISCORD: KyanG7#5428
or msg me ingame (KyanG7)

Hope this isn't used on any servers!
 




100 Posts | December 1st 2017<br /> Trial-Mod | ???
AmazinglyJava
AmazinglyJava
Member

190 posts
Minecraft: AmazinglyJava
Discord: Unknown
By AmazinglyJava » over 6 years ago
Kyan, read my post. (On your bug report)



Last edited: over 6 years ago
I'm a developer! Message me if you need help!<br /> <br /> Put "@Partydragen is a noob" in discord!
KyanG7
KyanG7
God

120 posts
Minecraft: KyanG7
Discord: Unknown
By KyanG7 » over 6 years ago
AmazinglyJava:
Kyan, read my post. (On your bug report)

I don't seem to be able to find my post... ?



Last edited: over 6 years ago
100 Posts | December 1st 2017<br /> Trial-Mod | ???
Partydragen
Partydragen
Owner

534 posts
Minecraft: Partydragen
Partydragen: Partydragen
Discord: partydragen
Minecraft-Community: Partydragen
By Partydragen » over 6 years ago
The author of this plugin aswered this:
Unfortunately this is a weakness in the Minecraft server rather than something I can fix with a plugin. I reported it a long time ago, but nothing has been done, and I suspect nothing will be done.
If blacklisting commands doesn't solve it for you, all I can suggest is keeping them in survival mode but then giving them creative-like powers using other plugins, instead of full creative mode.
The Too Many Items/Not Enough Items/Just Enough Items mods can make for an excellent infinite resources front-end for creative building and all they'd need is access to the /give command to make that work on the server side. There are lots of plugins for flight in survival mode and invulnerability too.




Owner of CubedCraft Network
Server Ip: mc.cubedcraft.com
My Website:
 http://partydragen.com/
AmazinglyJava
AmazinglyJava
Member

190 posts
Minecraft: AmazinglyJava
Discord: Unknown
By AmazinglyJava » over 6 years ago
partydragen, why don't you just make a plugin that clears all items with lore a players inventory unless they have a certain permission? It would take less than 30 minutes (I tried but failed :()

There is also other plugins such as DeluxeMenus that do the same thing. I haven't ever used any of them though.



Last edited: over 6 years ago
I'm a developer! Message me if you need help!<br /> <br /> Put "@Partydragen is a noob" in discord!
KyanG7
KyanG7
God

120 posts
Minecraft: KyanG7
Discord: Unknown
By KyanG7 » over 6 years ago
partydragen:
The author of this plugin aswered this:
Unfortunately this is a weakness in the Minecraft server rather than something I can fix with a plugin. I reported it a long time ago, but nothing has been done, and I suspect nothing will be done.
If blacklisting commands doesn't solve it for you, all I can suggest is keeping them in survival mode but then giving them creative-like powers using other plugins, instead of full creative mode.
The Too Many Items/Not Enough Items/Just Enough Items mods can make for an excellent infinite resources front-end for creative building and all they'd need is access to the /give command to make that work on the server side. There are lots of plugins for flight in survival mode and invulnerability too.
On one of my PlayerServers I spent tons of time creating menus with every single item (But my seperate banned items) if we get up to the time that we can upload files/configs I will love if Partydragen would take out my files and I could download them and spread it out the creative servers!
 




100 Posts | December 1st 2017<br /> Trial-Mod | ???
NeedYou
NeedYou
Royal

26 posts
Minecraft: NeedYou
Discord: Unknown
By NeedYou » over 6 years ago
Multiverse crashes my server even without any other plugin when creating a new world.




Cubedcraft Moderator glad to help in any cubed related issues. Contact me via discord and I will answer within 24 hours. If you see me on Cubed say Hey :D