Item Dupe/Spawning Exploit

Oh, I don't mind. I don't think we're gonna find a solution to the problem here anyway. Anyway, here's my CommandBook-only permissions list:

Code:

groups:
    Guest:
        default: true
        permissions:
        - commandbook.spawn
        prefix: '[&8Guest&f]&8 '
    Builder:
        permissions:
        - commandbook.whereami.compass
        - commandbook.whereami
        - commandbook.msg
        - commandbook.say.me
        - commandbook.spawn
        - commandbook.whereami.compass.other
        - commandbook.who
        prefix: '&f[Builder] '
    Moderator:
        inheritance:
        - SuperSponsor
        prefix: '[&3Moderator&f]&3 '
        permissions:
        - commandbook.slap
        - commandbook.slap.other
        - commandbook.rocket
        - commandbook.rocket.other
        - choptree.command.toggle
        - commandbook.spawnmob.*
        - commandbook.time
        - commandbook.kit.list
        - commandbook.kit.kits.mod

The permissions from "Builder" are inherited all the way up.

 

Hmm. I pretty much have the same thing in my permissions file. Do I have to install the bundled permissions.jar? I though it would've supported everything without the bridge.

 

Yes. The bundled Permissions.jar enables support for older plugins that look for Permissions 2.x.

 

@Lunar Delta
If you find the issue, id love it if you let us know or pm me about it atleast (So not to post it publicly), so it can be prevented.

 

I'll try that.

Thanks so much for the fast responses.

Yay! It works! Thanks so much!

EDIT by Moderator: merged posts, please use the edit button instead of double posting.

 

No problem.

 

Lunar, I think he is using a hacked client (or something like toomanyitems). Since you said he/she isn't using any commands

 

Well, it couldn't be TMI, because then I would have logs of the commands it sends.

 

perhaps something "like" it that doesn't send a command
That Malchus dude is a genius. I want him on my server

 

Hey OP, you using CommandSigns or Annotate by any chance? Or anything that elevates permissions in any way?

EDIT: Derp, re-read the op post. I've had a similar issue with CommandSigns and Permissions 3. The plugin would elevate a user's permissions to OP permissions temporarily to allow them to run a command they didnt have access to, and for some reason it would stick.

Did you check your permissions file to see if any erroneous user entries were created for his accounts? I had that happen a few times, people would randomly inherit '*' perm through the commandsign glitch.

 

lunar, what plugin do you have to see the commands people say

 

Hawkeye and the server.log itself, which I checked very, very thoroughly.

I checked his permissions also, he had the standard "guest" permissions, which only allow for use of one MCDocs commands and the /spawn command to get back to spawn.

 

VoxelPort will let pretty much anyone get free items and dupe all they want + wear blocks.

see /vhelm

 

Wow, I didn't know a plugin for teleportation between defined regions included such functionality. Why, it isn't even listed as a command anywhere on their wiki. Not cool.

I looked in the plugin.yml and didn't see any commands related to instant item spawning though. I'd like to know how though, because Voxel Port is very important to my server and I'd rather not get rid of it.