Kits containing commands and items can have their commands exploited infinitely - ignoring the cooldown - if the claimer has a full inventory
I-Knight-I opened this issue ยท 2 comments
Information
Full output of /ess version:
[12:05:27 INFO]: Server version: 1.16.1-R0.1-SNAPSHOT git-Paper-41 (MC: 1.16.1)
[12:05:27 INFO]: EssentialsX version: 2.17.2.136
[12:05:27 INFO]: PlaceholderAPI version: 2.10.6
[12:05:27 INFO]: LuckPerms version: 5.1.64
[12:05:27 INFO]: Vault version: 1.7.2-b107
[12:05:27 INFO]: Citizens version: 2.0.27-SNAPSHOT (build 2019)
[12:05:27 INFO]: EssentialsXChat version: 2.17.2.136
[12:05:27 INFO]: EssentialsXSpawn version: 2.17.2.136
Server log: https://gist.github.com/B-Knight49/d8ccee36218d6e3cb5a030dcfed743f2
EssentialsX config: https://gist.github.com/B-Knight49/6be5a86e7d0fe8095e42174b660427bd
Details
Description
If a player has a full inventory and a kit contains a mixture of commands as well as items, the kit will issue the commands but will fail to give the items. This tricks it into thinking the kit was not claimed and the cooldown will not activate. The claimer can then claim the kit and have the commands run again - repeat forever to exploit.
Steps to reproduce
drop-items-if-full: falsein config.yml- Create a kit that issues commands as well as items like so.
- Fill your inventory with items so no slot is free
- Claim the kit
- Commands are sent, player is told their inventory is full and the kit cooldown does not activate
- Reclaim the kit again for the commands to resend (repeat infinite times)
Expected behavior
If the claiming of a kit is interrupted, all items in a kit - regardless of type - MUST NOT be given to the claimer.
Screenshots
N/A
If I'm not mistaken, a fix for this bug (#3431, fix included both money and commands) was implemented in 2.17.2.137 - you might have missed it by just one build. Try updating to the newest version at https://essentialsx.net/downloads.html to see if your problem is resolved.
