Plugin Version: Compiled as of 01832d6
Minecraft Version: 1.19
Spigot/CraftBukkit version: Purpur dev 1735

Opening a ticket for tracking. I believe this change might be having negative consequences. Seems this issue is present even with the PR reverted.

If a person has flight enabled in one dimension and enters another dimension not touching the ground, they are allowed to keep flight on despite being disabled in that world.

i.e.

world - flight allowed
world_nether - flight disallowed

• Player enters nether portal from overworld flying / floating in the air.
• Player is put in nether dimension floating since it does not dimension change you on the ground but rather the exact center of the portal location.
• Player can fly around the nether. Flight does not get disabled by AntiWorldFly.
• If the player touches the ground, they cannot re-enable flight.

If you don't want to check every single movement for performance reasons, solution may be to add a check for setting flight status on dimension / world change if that world is disallowed?

Hopefully it isn't too complicated of a fix as word of the exploit is going around in my environment now that it's possible again.

I'm fairly confident I had covered this scenario back in the day. Maybe a regression was introduced, maybe Minecraft or Spigot behaviour has changed since then. :)

I'm having issues reproducing this. I'd like to know a little more about how you have AWF set up. Every configuration I've come up with for testing this is not tricking the dimension change listener, nor the WorldGuard region blocker.

The only way I'm able to reproduce something like what you describe is by blocking flight using /awf add world_nether and then allowing flight in the global world guard region for the nether. But that is expected behaviour as region flags are designed to override any per-world settings defined in the AWF config file.

I'd like to know what you have your "flight-enabled" flag set to in both the overworld and nether. Additionally, I'd like to see the output of /awf list.

p.s. apologies for the delay in responding, I've been busy with my day job as of late.

AWF config

antiFlyWorlds: 
  - world
  - world_nether
  - world_the_end
  - void
  - witp
  - resource

https://paste.gg/p/anonymous/a76223c56ea94282be315f14315635ec/files/e25dd89f931f4894bcb61428880f940d/raw

world_nether __global__ flags.

    __global__:
        members: {}
        flags:
            game-mode: survival
            blocked-cmds: [/version, /efeed, /reload, /eeat, /eecreative, /feed, /eheal,
                /creative, /op, /heal, /jumpto, /creativemode, /gm, /ecreativemode,
                /j, /eat, /egmc, /gmt, /egm, /thru, /pl, /plugins, /gamemode, /butcher,
                /egamemode, /gmc, /god, /stop, /egmt]
            invincible: deny
            pvp: deny
            quickshop-create: allow
        owners: {}
        type: global
        priority: 0

allowFlight: 'true' is flagged in all worlds in multiverse-core, as well as server.properties.

Players who are given access to /fly (essentials.fly globally) also have this permission to ignore flight check while in a certain world. They are not allowed to fly in other worlds.

- antiworldfly.fly.*:
    value: true
    context:
      world: world

• Build nether portal in overworld (world)
• Enable fly
• Float into the portal from the air
• Get put in nether dimension still floating from the half-way up point of the portal
• Can fly around the nether

I don't flag regions to allow/deny or set flight because certain groups I want to allow fly (such as staff) but certain groups I don't. I also default to flight not enabled for the player, everything handled by permissions.

Doing it from the ground with flight enabled in the overworld properly disables flight when trying to enter the air in the nether. I'm guessing the flight status isn't changed on dimension change (if the person doesn't have permission to fly) but rather if they are moving and flying in the air of that world?

I'm getting the issue to appear only after applying antiworldfly.fly.* perm with the context world=world (I'm using LuckPerms).

When I reworked the AWF permissions system I designed it such that the permission antiworldfly.fly.* will grant flight to all worlds whereas antiworldfly.fly.world_nether, for example, would only allow flight in the nether.

Admittedly I haven't ever used permission contexts until now. I'm not sure how these are handled, is it something the plugin is expected to query from the server??

What happens if you switch the antiworldfly.fly.* with context world=world perm out for antiworldfly.fly.worldwithout any contexts? I'm thinking the issue lies in how the contexts are managed with either the permissions plugin.