Carpet

Carpet

2M Downloads

Security Risk: Command /player Can Summon Real Player in the Server

OrdosX opened this issue ยท 1 comments

commented

What's expected

Say a Minecraft server has a player named OrdosX. When another player typed /player ordosx spawn , the plugin should throw an error to prevent it, or summon a completely new player entity like using other names.

What's happening

The command above actually summon the real OrdosX with all its items, experience and armor. Here are what I found in my server:

  • When the summoned entity is killed, it acts as if the real player is killed (like dropping items).
  • If player OrdosX connects the server when the entity still exists, it will login in where the entity is.
  • The player will inherit the HP, effect etc. of the entity.

Environments

Minecraft server: 1.14.4, vanilla
Fabric API: 0.4.2 build 246
Fabric loader: 0.5.2.39
Carpet mod: fabric-carpet-1.14.4-1.3.5 v200114

commented

This is intended, that's why there is an option for operators to customize which commands are available for the players and which are not. /carpet commandPlayer can be spec'ed as 'true' - as available for all, 'false' - for none, 'ops' for operators or a number from 0-4 for custom permission level. This way you can disable the use of these for regular players possibly allowing them to run them through functions or triggers.