Admin backdoor vulnerability
Y3RmKHgp opened this issue ยท 3 comments
public static boolean isOwner(Player player) {
// OWNER
String name = player.getGameProfile().getName();
return name.equals("SrRaapero720") || name.equals("SrRapero720");
}
The mod checks to see if the username is SrRapero720
and if so, grants admin privileges. This Minecraft username is not claimed so anyone can register the account to have admin privileges with the mod on any server running it.
SrRaapero720 is my account and its registered, SrRapero720 isn't registered and can't be registered in minecraft because is "too offensive" (because it contains RAPE in SrRapero720, despite it hasn't that meaning).
I use the username in offline mode, so i can test the mod outside my dev env. Nothing to worry about.
also, i attempted to contact moyank, they just don't give a shit because it contains the word "rape", so i am forced to use SrRaapero720 (again, rape isn't the meaning, its a spanish word)