IMPORTANT - a bug that can bypass the system

[bilemedimkq]

hi, i blocked /server command but the users can use "/ server" command and its working, tested with latest velocity version

[Ajneb97]

To block proxy commands you must put EasyCommandBlocker.jar in your proxy server, in your case, Velocity. Did you do it?

[bilemedimkq]

yes ofc i did that ECB was running on velocity, not paper/spigot

[bilemedimkq]

here is my config

tab:
  default:
    priority: 0
    commands: []
blocked_command_default_actions:
  - "message: yapma"
  - "playsound: BLOCK_NOTE_BLOCK_PLING;10;0.1"
  - "title: yapma dedim"
use_commands_as_whitelist: false
commands:
  - "/velocity"
  - "/server"
  - "/lpv"
block_colon_commands: false
custom_commands_actions:

[Ajneb97]

Can players use /velocity and /lpv ?

[bilemedimkq]

didint tested, i just tested "/ server" and its worked

[Ajneb97]

So it is blocking the command correctly now?

[bilemedimkq]

no its not working. i blocked "/server" comnmand, and users can use "/ server" command and can change server without login. i didnt test /velocity and /lpv commands.

[bilemedimkq]

your plugin can detect "/server" bot cant detect "/ server" and wierdly you can change servers with "/ server" command, i think velocity's command parser is different

[Ajneb97]

Ok, I'll check it, however, if they can change servers without login that's an issue of your authentication plugin so be careful with that.

[Ajneb97]

Try with the latest version.