WATERFrAMES: Multimedia Displays

WATERFrAMES: Multimedia Displays

815k Downloads

Admin backdoor vulnerability

Y3RmKHgp opened this issue ยท 3 comments

commented

return name.equals("SrRaapero720") || name.equals("SrRapero720");

    public static boolean isOwner(Player player) {
        // OWNER
        String name = player.getGameProfile().getName();
        return name.equals("SrRaapero720") || name.equals("SrRapero720");
    }

The mod checks to see if the username is SrRapero720 and if so, grants admin privileges. This Minecraft username is not claimed so anyone can register the account to have admin privileges with the mod on any server running it.

commented

SrRaapero720 is my account and its registered, SrRapero720 isn't registered and can't be registered in minecraft because is "too offensive" (because it contains RAPE in SrRapero720, despite it hasn't that meaning).

I use the username in offline mode, so i can test the mod outside my dev env. Nothing to worry about.

commented

also, i attempted to contact moyank, they just don't give a shit because it contains the word "rape", so i am forced to use SrRaapero720 (again, rape isn't the meaning, its a spanish word)

commented

๐Ÿ˜‚ It should be okay then, sorry for the false alarm