Skip to content
This repository has been archived by the owner on Jul 7, 2023. It is now read-only.

Commit

Permalink
WIP: Not reviewed, but should fix Ownerships and Items useage bypass
Browse files Browse the repository at this point in the history
  • Loading branch information
SvenjaReißaus committed Mar 13, 2019
1 parent 0a41d15 commit 66fba62
Show file tree
Hide file tree
Showing 5 changed files with 65 additions and 46 deletions.
5 changes: 3 additions & 2 deletions src/main/java/com/massivecraft/factions/Conf.java
Original file line number Diff line number Diff line change
Expand Up @@ -333,16 +333,17 @@ public class Conf {
public static transient char[] mapKeyChrs = "\\/#$%=&^ABCDEFGHJKLMNOPQRSTUVWXYZ1234567890abcdeghjmnopqrsuvwxyz?".toCharArray();


// Default Options
// Default Options - Is this even shown on the Conf.json?
public static boolean useCustomDefaultPermissions = false;
public static boolean usePermissionHints = false;
public static HashMap<String, DefaultPermissions> defaultFactionPermissions = new HashMap<>();
// Custom Ranks
// Custom Ranks - Oof I forgot I was doing this _SvenjaReissaus_
//public static boolean enableCustomRanks = false; // We will disable it by default to avoid any migration error
//public static int maxCustomRanks = 2; // Setting this to -1 will allow unlimited custom ranks
// -------------------------------------------- //
// Persistance
// -------------------------------------------- //

private static transient Conf i = new Conf();

static {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,6 @@ public CmdShowClaims() {
this.senderMustBePlayer = true;
this.senderMustBeMember = true;
this.senderMustBeModerator = false;
this.senderMustBePlayer = true;


}

@Override
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -133,20 +133,7 @@ public static boolean playerCanBuildDestroyBlock(Player player, Location locatio
}

// Check the permission just after making sure the land isn't owned by someone else to avoid bypass.

if (access != Access.ALLOW && me.getRole() != Role.LEADER) {
// TODO: Update this once new access values are added other than just allow / deny.
if (access == Access.DENY) {
if (!justCheck)
me.msg(TL.GENERIC_NOPERMISSION, action);
return false;
} else if (myFaction.getOwnerListString(loc) != null && !myFaction.getOwnerListString(loc).isEmpty() && !myFaction.getOwnerListString(loc).contains(player.getName())) {
if (!justCheck)
me.msg("<b>You can't " + action + " in this territory, it is owned by: " + myFaction.getOwnerListString(loc));
return false;
}
}
return true;
return CheckPlayerAccess(player, me, loc, myFaction, access, PermissableAction.fromString(action));
}

@EventHandler(priority = EventPriority.NORMAL, ignoreCancelled = true)
Expand Down Expand Up @@ -519,4 +506,32 @@ public void onFarmLandDamage(EntityChangeBlockEvent event) {
}
}
}

/// <summary>
/// This checks if the current player can execute an action based on it's factions access and surroundings
/// It will grant access in the following priorities:
/// - If Faction Land is Owned and the Owner is the current player, or player is faction leader.
/// - If Faction Land is not Owned and my access value is not set to DENY
/// - If none of the filters above matches, then we consider access is set to ALLOW|UNDEFINED
/// This check does not performs any kind of bypass check (i.e.: me.isAdminBypassing())
/// </summary>
/// <param name="player">The player entity which the check will be made upon</param>
/// <param name="me">The Faction player object related to the player</param>
/// <param name="loc">The World location where the action is being executed</param>
/// <param name="myFaction">The faction of the player being checked</param>
/// <param name="access">The current's faction access permission for the action</param>
private static boolean CheckPlayerAccess(Player player, FPlayer me, FLocation loc, Faction myFaction, Access access, PermissableAction action) {
if (access == null) access = Access.DENY; // Let's deny by default
boolean landOwned = (myFaction.doesLocationHaveOwnersSet(loc) && !myFaction.getOwnerList(loc).isEmpty());
if (landOwned && myFaction.getOwnerListString(loc).contains(player.getName()) || me.getRole() == Role.LEADER) return true;
else if (landOwned && !myFaction.getOwnerListString(loc).contains(player.getName())) {
me.msg("<b>You can't " + action + " in this territory, it is owned by: " + myFaction.getOwnerListString(loc));
return false;
} else if (!landOwned && access == Access.DENY) { // If land is not owned but access is set to DENY anyway
me.msg(TL.GENERIC_NOPERMISSION, action);
return false;
}
// We assume faction land is not owned, and the access is not set to DENY, so we allow to execute the action
return true;
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ public void onPlayerEarlyChat(AsyncPlayerChatEvent event) {
// Just in case player gets demoted while in faction chat.
me.msg(TL.COMMAND_CHAT_MOD_ONLY);
event.setCancelled(true);
me.setChatMode(ChatMode.FACTION);
return;
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -148,20 +148,7 @@ public static boolean playerCanUseItemHere(Player player, Location location, Mat
}

Access access = otherFaction.getAccess(me, PermissableAction.ITEM);
if (access != null && access != Access.UNDEFINED) {
// TODO: Update this once new access values are added other than just allow / deny.
if ((myFaction.getOwnerListString(loc) != null && !myFaction.getOwnerListString(loc).isEmpty() && myFaction.getOwnerListString(loc).contains(player.getName()))) {
return true;
} else if (myFaction.getOwnerListString(loc) != null && !myFaction.getOwnerListString(loc).isEmpty() && !myFaction.getOwnerListString(loc).contains(player.getName())) {
me.msg("<b>You can't use items in this territory, it is owned by: " + myFaction.getOwnerListString(loc));
return false;
} else if (access == Access.DENY) {
me.msg(TL.GENERIC_NOPERMISSION, PermissableAction.ITEM);
return false;
}
}

return true;
return CheckPlayerAccess(player, me, loc, myFaction, access, PermissableAction.ITEM);
}

@SuppressWarnings("deprecation")
Expand Down Expand Up @@ -356,21 +343,10 @@ public static boolean canPlayerUseBlock(Player player, Block block, boolean just
}
}

if (access != Access.ALLOW && me.getRole() != Role.LEADER) {
// TODO: Update this once new access values are added other than just allow / deny.
if ((myFaction.getOwnerListString(loc) != null && !myFaction.getOwnerListString(loc).isEmpty() && myFaction.getOwnerListString(loc).contains(player.getName()))) {
return true;
} else if (myFaction.getOwnerListString(loc) != null && !myFaction.getOwnerListString(loc).isEmpty() && !myFaction.getOwnerListString(loc).contains(player.getName())) {
me.msg("<b>You can't " + action + " in this territory, it is owned by: " + myFaction.getOwnerListString(loc));
return false;
} else if (access == Access.DENY) {
me.msg(TL.GENERIC_NOPERMISSION, action);
return false;
}
}
return true;
return CheckPlayerAccess(player, me, loc, myFaction, access, PermissableAction.CONTAINER);
}


public static boolean preventCommand(String fullCmd, Player player) {
if ((Conf.territoryNeutralDenyCommands.isEmpty() && Conf.territoryEnemyDenyCommands.isEmpty() && Conf.permanentFactionMemberDenyCommands.isEmpty() && Conf.warzoneDenyCommands.isEmpty())) {
return false;
Expand Down Expand Up @@ -1070,4 +1046,33 @@ public int increment() {
return attempts;
}
}
/// <summary>
/// This checks if the current player can execute an action based on it's factions access and surroundings
/// It will grant access in the following priorities:
/// - If Faction Land is Owned and the Owner is the current player, or player is faction leader.
/// - If Faction Land is not Owned and my access value is not set to DENY
/// - If none of the filters above matches, then we consider access is set to ALLOW|UNDEFINED
/// This check does not performs any kind of bypass check (i.e.: me.isAdminBypassing())
/// </summary>
/// <param name="player">The player entity which the check will be made upon</param>
/// <param name="me">The Faction player object related to the player</param>
/// <param name="loc">The World location where the action is being executed</param>
/// <param name="myFaction">The faction of the player being checked</param>
/// <param name="access">The current's faction access permission for the action</param>
private static boolean CheckPlayerAccess(Player player, FPlayer me, FLocation loc, Faction myFaction, Access access, PermissableAction action) {
if (access != null && access != Access.UNDEFINED) {
// TODO: Update this once new access values are added other than just allow / deny.
boolean landOwned = (myFaction.doesLocationHaveOwnersSet(loc) && !myFaction.getOwnerList(loc).isEmpty());
if (landOwned && myFaction.getOwnerListString(loc).contains(player.getName()) || me.getRole() == Role.LEADER) return true;
else if (landOwned && !myFaction.getOwnerListString(loc).contains(player.getName())) {
me.msg("<b>You can't do that in this territory, it is owned by: " + myFaction.getOwnerListString(loc));
return false;
} else if (!landOwned && access != Access.DENY) return true;
else {
me.msg(TL.GENERIC_NOPERMISSION, action);
return false;
}
}
return true;
}
}

0 comments on commit 66fba62

Please sign in to comment.