Hidendra/LWC — Issue #202: permission not checked on block interact
Author: Darktemp
Created: 2011-12-29 01:34:21+00:00
State: open

We use LWC 4.0.2 (b576).
Following scenario:
1. A player types "/cprivate".
2. The permission changes. *
3. The player clicks something to protect.

Result is, that the player can create the protection, but cannot use /cprivate again. More fatal is it if the player has /cpersist active, then he is able to create as many protections as he likes without permission.
As I see in the code, there is a permissioncheck at
https://github.com/Hidendra/LWC/blob/devel/modules/core/src/main/java/com/griefcraft/modules/create/CreateModule.java#L100
but it doesn't deny the access while none of the following permissions are set at that time: "lwc.create.private", "lwc.create", "lwc.protect"

(*In our case, the player changes the world and in that target world is no lwc permission allowed. But it is reproducable if you change the permission of that player via console or change its group.)