weiiswurstdev / easyconomy Goto Github PK

Hello,
I'm running a server for some friends and I noticed that even if I didn't give them the permission, they could get the account balance of others.
Here is a piece of my config.yml :

enable-logging: false

permissions:
  README: >
    IF YOU WANT THE PLUGIN TO USE PERMISSIONS,
    WRITE THE PERMISSIONS DOWN IN THE "".
    EMPTY QUOTATION MARKS => BALANCE AND OTHERSBALANCE AND PAY FOR EVERYONE
    AND MODIFY FOR OP ONLY
  balance: "ec.balance.self"
  othersBalance: "ec.balance.other"
  pay: "ec.pay"
  modify: "ec.modify"

And a piece of my bPermission config :

default: default
groups:
  default:
    permissions:
    - ec.balance.self
    - ^ec.balance.other
    - ec.pay

I noticed that in src/main/java/dev/wwst/easyconomy/commands/BalanceCommand.java, you check if the player has permissions.balance but never permissions.othersBalance.

I would have liked to fix it myself, but I'm still learning Java and I don't know where to find the librairies to compile your code.

I'm right here if you need further informations :)

There is currently no explicit license, which especially on Github can be problematic and even more so thanks to bukkit's license which makes matters even more complicated, I recommend you to set the license explicitly as otherwise potential contributors may not know what they can do with the application and source.

Hi,
EC seems to to be broken: The chestcommands plugin does not recognize it as eco plugin.
Thanks!
(Endlich mal ein Plugin mit demselben system wie EssX)

Well, pretty much the same issue as of #8 but can actually be fixed a bit better

Reason for this is that the plugin is reliant on UUIDs, however for illegal playernames it still queries mojang's database through the Bukkit.getOfflinePlayer(name) method, since that queries the internet it is terribly inefficent for something we know won't get us far. Illegal playernnames are used by plugins such as Towny and are used as an alternative to Banks. These can also be spotted pretty easily as they include illegal characters such as -, $, / or others.

Fixing it would be a significant feat since it would need to be converted in one way or another, however this conversion would be pretty hard as we cannot reconstruct the playername of a UUID.