Merge remote-tracking branch 'Slimefun/master'

DEV - 1013 Slimefun日誌: - 修復非管理員的玩家可以開啟設定並繞過作弊選單的限制
xMikux · Apr 25, 2022 · c6f027a · c6f027a
2 parents a9df60e + 5cfc4f7
commit c6f027a
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -46,6 +46,7 @@
 * Fixed #3504
 * Fixed #3534
 * Fixed #3538
+* Fixed #3548
 
 ## Release Candidate 31 (14 Mar 2022)
 https://thebusybiscuit.github.io/builds/TheBusyBiscuit/Slimefun4/stable/#31

diff --git a/...n/java/io/github/thebusybiscuit/slimefun4/implementation/guide/SurvivalSlimefunGuide.java b/...n/java/io/github/thebusybiscuit/slimefun4/implementation/guide/SurvivalSlimefunGuide.java
@@ -311,7 +311,7 @@ private void displaySlimefunItem(ChestMenu menu, ItemGroup itemGroup, Player p,
                 try {
                     if (isSurvivalMode()) {
                         displayItem(profile, sfitem, true);
-                    } else {
+                    } else if (pl.hasPermission("slimefun.cheat.items")) {
                         if (sfitem instanceof MultiBlockMachine) {
                             Slimefun.getLocalization().sendMessage(pl, "guide.cheat.no-multiblocks");
                         } else {
@@ -323,6 +323,13 @@ private void displaySlimefunItem(ChestMenu menu, ItemGroup itemGroup, Player p,
 
                             pl.getInventory().addItem(clonedItem);
                         }
+                    } else {
+                        /*
+                         * Fixes #3548 - If for whatever reason,
+                         * an unpermitted players gets access to this guide,
+                         * this will be our last line of defense to prevent any exploit.
+                         */
+                        Slimefun.getLocalization().sendMessage(pl, "messages.no-permission", true);
                     }
                 } catch (Exception | LinkageError x) {
                     printErrorMessage(pl, x);