Non-Owners gaining owner privs of regions
SquallSeeD31 opened this issue ยท 1 comments
At line 992 of https://github.com/sk89q/worldguard/blob/master/src/com/sk89q/worldguard/bukkit/WorldGuardPlugin.java the following check occurs:
if (!canUseRegionCommand(player, "/regiondefine")
&& !existing.isOwner(wrapPlayer(player))) {
player.sendMessage(ChatColor.RED + "You don't own this region.");
return true;
}
Based on the way this is written, a user who has access to /regiondefine automatically breaks the conditional because it uses an AND operator, and therefore will get added as an owner of the existing region.
A user who has access to /regiondefine should not get added as an owner of the region, as the owner of the region is taken from the passed arguments.
A user with /regiondefine has access to a lot of commands. It is an admin-level permission. /regionclaim is the user-level permission.