Acru/Lockette — pull request #2 by Hidendra (2012-07-12 06:19:02+00:00)
Title: Fix unrestricted access that is given to `Acru'

Hello.

In the current release version (that is, 1.6 and the fork 1.7) there exists code that permits unrestricted access to the following:

* Interaction of any Lockette-protected sign to allow selection for editing
* The command `/lockette` (that is, allowing the editing of any line on a Lockette-protected sign)

Used in combination, one could assign themselves membership to any Lockette-protected block. Afterwards, they could in theory simply remove themselves once they've made off with the goods.

While I do not believe your intentions to be malicious (merely accidental, given no widespread reports of such cat-burglary are happening), this represents a *serious* implication on servers that use an offline-server model and Lockette. This means that anyone can login using `Acru` and have nearly immediate access to any and all protections that use Lockette.