Merge pull request #190 from SpigotRCE/patch-1

Fixed plugin messaging exploit
Syrent · Nov 27, 2024 · 2693604 · 2693604
2 parents 0e40256 + ab36efe
commit 2693604
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/src/main/java/ir/syrent/velocityreport/utils/ruom/messaging/VelocityMessagingChannel.java b/src/main/java/ir/syrent/velocityreport/utils/ruom/messaging/VelocityMessagingChannel.java
@@ -39,8 +39,9 @@ public void unregister(VelocityMessagingEvent messagingEvent) {
 
     @Subscribe
     public void onMessageReceive(PluginMessageEvent event) {
-        if (!(event.getSource() instanceof ServerConnection)) return;
-        if (!event.getIdentifier().equals(name)) return;
+        if (!event.getIdentifier().equals(name)) return; // Not our channel
+        event.setResult(PluginMessageEvent.ForwardResult.handled()); // Drop the packet
+        if (!(event.getSource() instanceof ServerConnection)) return; // Somebody is trying to hack us
 
         String rawMessage = new String(event.getData(), StandardCharsets.UTF_8);
         if (rawMessage.isEmpty()) return;
@@ -60,4 +61,4 @@ public ChannelIdentifier getName() {
         return name;
     }
 
-}
+}