WORLDGUARD-2670 - Reported by PseudoKnight

This is a major security concern for most servers on 1.5.1, especially considering hopper minecarts can be pushed into a region under any elevated chest or other container.

http://jd.bukkit.org/dev/apidocs/org/bukkit/event/inventory/InventoryMoveItemEvent.html

I recommend admins disable hopper minecarts completely until all your container protection plugins add support for this. (Logblock doesn't track this event yet)

Comment by PseudoKnight

To expand on this, regular hoppers don't need the event for protection. You can just check the above block to see if it's a container block and protected by a region for which the player can't build or access chests.

The hopper minecart is different, though. It can be placed anywhere and pushed in. You could setup a vehicle move protection, I guess, but an InventoryMoveItemEvent is perhaps the more desirable solution? The trouble is you don't know who placed the hopper minecart, so you'd just have to have a flag disabling hopper minecarts in a region. You'd also need to decide whether it should default to allow or deny. I'm leaning towards deny to be consistent with what people expect a region to protect. So you'd check if it's a hopper minecart and then check if the container block is protected.

I wish there was a better way. It's certainly a challenging problem. Any ideas?

Comment by Fahlur

I have a solution, make it so players not owner of the region the Hopper/chest cart resides in, can not access that item.. Using a temporary means via plugin you check for a interact event, then check of its a hopper_cart or chest_cart and if it is, then check the protection at that location (if there is one), check if they are a member or owner, if not setCancelled(true), return you dont have access error.

also this issue still exists in 6.1

Comment by PseudoKnight

That doesn't address people moving hopper minecarts into and out of regions. Besides, pretty sure regions already protect against inventory minecart interactions.