[BungeeCord / Velocity] Block bridge communication messages from play…

…er to avoid exploits
NEZNAMY · Mar 1, 2025 · ba06f80 · ba06f80
1 parent ee47428
commit ba06f80
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 3 deletions.
diff --git a/bungeecord/src/main/java/me/neznamy/tab/platforms/bungeecord/BungeeEventListener.java b/bungeecord/src/main/java/me/neznamy/tab/platforms/bungeecord/BungeeEventListener.java
@@ -97,8 +97,9 @@ public void onCommand(ChatEvent e) {
     @EventHandler
     public void onPluginMessage(PluginMessageEvent e) {
         if (!e.getTag().equals(TabConstants.PLUGIN_MESSAGE_CHANNEL_NAME)) return;
+        e.setCancelled(true); // Also cancel messages from players to prevent exploits
+        if (TAB.getInstance().isPluginDisabled()) return;
         if (e.getReceiver() instanceof ProxiedPlayer) {
-            e.setCancelled(true);
             pluginMessage(((ProxiedPlayer) e.getReceiver()).getUniqueId(), e.getData());
         }
     }

diff --git a/velocity/src/main/java/me/neznamy/tab/platforms/velocity/VelocityEventListener.java b/velocity/src/main/java/me/neznamy/tab/platforms/velocity/VelocityEventListener.java
@@ -122,10 +122,10 @@ public void onCommand(@NotNull CommandExecuteEvent e) {
      */
     @Subscribe
     public void onPluginMessageEvent(@NotNull PluginMessageEvent e) {
-        if (TAB.getInstance().isPluginDisabled()) return;
         if (!e.getIdentifier().getId().equals(TabConstants.PLUGIN_MESSAGE_CHANNEL_NAME)) return;
+        e.setResult(PluginMessageEvent.ForwardResult.handled()); // Also cancel messages from players to prevent exploits
+        if (TAB.getInstance().isPluginDisabled()) return;
         if (e.getTarget() instanceof Player) {
-            e.setResult(PluginMessageEvent.ForwardResult.handled());
             pluginMessage(((Player) e.getTarget()).getUniqueId(), e.getData());
         }
     }