Versions

WorldEdit version: Bukkit-Official(7.2.0-SNAPSHOT+5296-e4da681)
WorldGuard version: Bukkit-Official (7.0.4-SNAPSHOT+2067-91a1494)
Platform version: Paper version git-Paper-136 (MC: 1.16.1)

Describe the bug

I allow all users to use WorldEdit on the Creative mode (PlotSquared v5) part of my server, and right now, the DisallowedBlocks list is not working. I have read up on permissions, and denied the worldedit.anyblock permission (using LuckPerms). Note: I am using the Worldedit.* permissions node, and just denying permissions that I don't want. Is this supported behavior, or am I in the wrong? Denying worldedit.replacenear works just fine.

To Reproduce

1. Login with an account that uses the default group on LuckPerms.
2. Go to the PlotSquared world and use Worldedit in an assigned plot.
3. Try replacing/setting blocks to disallowed blocks like TNT, Sand, etc.
4. Disallowed blocks does not work, players can set denied blocks, much to my chagrin.
5. No message to player, no error in console? What's going on?

Expected behavior

A message saying that the player cannot set/replace blocks to those denied in the config file.
Maybe even an error/stack-trace in console if this was a regular bug?

Screenshots

Additional context

 Plugins (46): AntiDisconnectSpam, BlockLocker, Bookshelves, Cannons, ChatEx*, ChestShop, ChestSort, ClearLag,
CommandAlias, CoreProtect, dynmap*, Essentials, ExecutableItems, Factions, floodgate-bukkit, Geyser-Spigot, GSit,
IridiumSkyblock, LagMonitor, LoginSecurity*, LuckPerms,
Multiverse-Core, Multiverse-NetherPortals, Multiverse Portals,
PerWorldInventory, PlaceholderAPI, Plan, Plot2Dynmap, PlotSquared, PlugMan, ProtocolLib, ServerListPlus*, Ships,
SkinsRestorer, TheNewEconomy, TradeSystem, UberEnchant, Vault, ViaBackwards, ViaRewind, ViaVersion, VoidGenerator,
WarpSystem, WorldBorder, WorldEdit, WorldGuard

WorldEdit config.yml
WorldGuard config.yml
My server is running in offline mode. Could this be a UUID issue?

I've upgraded from a *Minecraft version older than 1.13. Should I delete the config files and start fresh? I noticed that the disallowed-blocks list is using numerical IDs, not bukkit/spigot material IDs.

It would probably be best for you to update the list, but note it is not meant as a security measure, but a typo prevention. See #1323.

Is there something simple I could do as a security measure, besides defining specific permissions? I know permissions are very granular for WorldEdit, but I don't want to take the time to go through the full list.

No. WorldEdit isn't intended to be given to untrusted users, so it doesn't have inbuilt security measures, only surface level accident prevention.
Also yea, WE makes no attempt to convert legacy configs. Not really sure if we care to change that tbh.

Okay, definitely user error! I deleted the old config file and restarted, and now it works as expected. I'll look at other solutions to give my players power, but not too much power.