[SPIGOT-3744] Command#broadcastCommandMessage incorrectly uses Permission subscription status alone to collect recipients Created: 06/Jan/18 Updated: 06/Jan/18 Resolved: 06/Jan/18 |
|
| Status: | Resolved |
| Project: | Spigot |
| Component/s: | None |
| Affects Version/s: | None |
| Fix Version/s: | None |
| Type: | Bug | Priority: | Minor |
| Reporter: | Luck | Assignee: | Unassigned |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Environment: |
Latest Spigot build - although it seems this issue has been present for a long time. (since 1.7 at least) |
||
| Description |
|
Command#broadcastCommandMessage is intended to replicate Vanilla broadcast style messages for Bukkit commands. ("[<sender name>: <message>]" in gray) In order to collect recipients, it uses PluginManager#getPermissionSubscriptions to return a list of Permissibles which have the permission set.
However, the returned set includes ALL permissibles, even ones with the permission set to false, which leads to the following bug. https://paste.md-5.net/fegufahigo.java https://luck.sh/O8TTlqTNWL9PVfjjp0Gx-UptxrQ= For example, if you set the administrative broadcast permission to false for a player, they will still receive admin broadcast messages, because a false setting still subscribes them to the permission.
This issue does not exist in Server#broadcast, as an additional permission check is performed.
|