IntellectualSites / IntellectualSites/PlotSquared
Players can bypass plot protection by using buckets on use-allowed blocks
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 653
- Forks
- 975
- Avg merge
- 2m
- Merged PRs (30d)
- 6
Description
Server Implementation
Paper
Server Version
1.21.11
Describe the bug
See video
To Reproduce
- Set a use flag that accepts blocks able to be flooded with liquid (e.g. levers)
- While holding a filled bucket, shift-right-click on a use-flag interactable block such that it would be placed in the foldable use-flag block
Expected behaviour
Unadded players to not be able to empty liquids on a plot
Screenshots / Videos
https://github.com/user-attachments/assets/a642b5fc-6902-4985-9d04-b940ff669803
Error log (if applicable)
No response
Plot Debugpaste
https://athion.net/ISPaster/paste/view/7abb0398dbe14adc9b8b0358b6d60029
PlotSquared Version
7.5.13-SNAPSHOT
Checklist
- I have included a Plot debugpaste.
- I am using the newest build from https://www.spigotmc.org/resources/77506/ and the issue still persists.
Anything else?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at Bukkit/src/main/java/com/plotsquared/bukkit/listener/PlayerEventListener.java around line 1426 and reproduce the bucket interaction using the listed steps on PlotSquared 7.5.13-SNAPSHOT. Trace how use-allowed blocks and filled buckets are handled, then verify that unadded players cannot empty liquids on a plot while allowed interactions still work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100