Bentobox: Various commands can expose vanished players

[Poslovitch]

Description

Describe the bug

Commands such as coop, trust or invite can expose vanished players.

Steps to reproduce the behavior

1. Install BentoBox, BSkyBlock and a vanish plugin (e.g. ProtocolVanish).
2. Connect the first account as a regular player.
3. Create an island.
4. Connect the second account as an administrator and put it in vanish.
5. As the regular player, execute /is team invite .
   => It will send the invite, thus letting the regular player know the administrator is online.

Screenshots and videos

None.

Expected behavior

Players "hidden" by vanish plugins should not be exposed through the commands. They should be deemed "offline" by the plugin.
The same should go for tab-completion (and it has already been reported and fixed a while ago on ASB).

As far as I know, we can check if the player's vanished by using Player#canSee().

Environment

Server

• OS: Windows 10 x64
• Java version: Java 8

Plugins

Plugins (2):
BentoBox, ProtocolVanish

BentoBox setup

BentoBox and Addons

Running SPIGOT 1.14.4.
BentoBox version: 1.8.0
Database: JSON
[...]
Loaded Addons:
BSkyBlock 1.6.0 (ENABLED)

Configuration

• Database: JSON

Additional context

None.

[tastybento]

getOnlinePlayerList in the Util class already filters out hidden players so tabComplete should not show them unless you are Op or Console.
For the other items, I think it'd be a good idea to look into a universal "get target player" method in CompositeCommand that will filter out unknown and invisible players appropriately. It's used a lot in the commands.

[Poslovitch]

For the other items, I think it'd be a good idea to look into a universal "get target player" method in CompositeCommand that will filter out unknown and invisible players appropriately. It's used a lot in the commands.

Agreed.

[Paul19988]

Another command which exposes those in Vanish is /is team trust

It will provide the player a list of admins which are online if they trust every admin.

[Paul19988]

https://github.com/BentoBoxWorld/BentoBox/pull/1499

Created PR to support making vanished players appearing offline
(Note this PR should only be considered as a temporary fix for users & to be replaced at a later date with a more in-depth system.

EDIT: This has since been adjusted to use the correct methods & will need approval for merge

[piotrskibapl]

@tastybento I'm not sure if this issue should be closed.
It seems to me that the Pull Request from @Paul19988 fixes the "/island team" command as it was exposing vanished players, but it doesn't fix commands mentioned in this issue (like trust/coop/invite).

[tastybento]

@piotrskibapl Good point. Let's review:

• [x] Tab-complete protection for invite, trust, and coop. Vanished players are not revealed.
• [x] For trust and coop, it is possible to invite offline players, so there is no info that can be found by using them.
• [x] The team member list in /is team is protected by this PR.
• [x] Team invite command is fixed by the commit above

Are there any other ways left that the vanished player can leak out?

[piotrskibapl]

@tastybento after some testing I found only one command that can expose vanished players now - "/is expel" (via tab completions, assuming that the vanished player is on your island). Might it be caused by changes from #1509 ?

[tastybento]

@piotrskibapl Thanks. It should be fixed in the latest build. I also added some other limits to the expel tab-complete so it won't show Ops and mods/admins with expel prevention permissions.

[piotrskibapl]

I tested this on build #1860 and it works fine, thanks. I didn't find any other possibilities to expose vanished players - in my opinion the issue could be closed now.