WorldGuard

WorldGuard

Bukkit Plugins
8M Downloads

Bypass permissions using "-w world" in a command

LadyCailinBot opened this issue ยท 2 comments

commented

WORLDGUARD-2724 - Reported by Phoenix_IV

WorldGuard version: 5.7.3

Using the -w flag in a command to specify a world bypasses all permissions.
I tried it out on a random server and was able to set myself as the owner of a region and build in there (''/rg addowner aTitledRegion -w world Phoenix_IV'').

One has to know the world and the region name of course, but as you can see that's not always a problem.
You may want to hide this message to avoid griefing on different servers.

commented

Comment by wizjany

I've hidden the issue for now and a release is already on bukkitdev waiting for approval.

commented

Comment by Phoenix_IV

It seems like it still works for {color:#666666}/rg flag{color}.

Verifying fix for {color:#666666}addowner, removeowner, addmember, removemember{color}
Other commands were not tested before, but there is no problem wit them in v5.7.4