From 70641af27a6a8f55707fb5600911b0d26845f26d Mon Sep 17 00:00:00 2001 From: Ben Date: Fri, 18 Sep 2026 15:58:35 -0600 Subject: [PATCH 1/2] Fix VoteGUI permissions in offline mode --- .../commands/gui/player/VoteGUI.java | 16 ++++-- .../gui/player/VoteGUIPermissionTest.java | 56 +++++++++++++++++++ 2 files changed, 67 insertions(+), 5 deletions(-) create mode 100644 VotingPlugin/src/test/java/com/bencodez/votingplugin/commands/gui/player/VoteGUIPermissionTest.java diff --git a/VotingPlugin/src/main/java/com/bencodez/votingplugin/commands/gui/player/VoteGUI.java b/VotingPlugin/src/main/java/com/bencodez/votingplugin/commands/gui/player/VoteGUI.java index a74832731d..29f5ee1990 100644 --- a/VotingPlugin/src/main/java/com/bencodez/votingplugin/commands/gui/player/VoteGUI.java +++ b/VotingPlugin/src/main/java/com/bencodez/votingplugin/commands/gui/player/VoteGUI.java @@ -1,6 +1,7 @@ package com.bencodez.votingplugin.commands.gui.player; import java.util.ArrayList; +import java.util.Objects; import org.bukkit.command.CommandSender; import org.bukkit.entity.Player; @@ -180,6 +181,15 @@ public void onChat(CommandSender sender) { // not available } + static String getRequiredPermission(VotingPluginMain plugin, Player player, VotingPluginUser viewedUser) { + VotingPluginUser viewingUser = plugin.getVotingPluginUserManager().getVotingPluginUser(player); + if (viewingUser != null && viewedUser != null + && Objects.equals(viewingUser.getUUID(), viewedUser.getUUID())) { + return "VotingPlugin.Commands.Vote.GUI"; + } + return "VotingPlugin.Commands.Vote.GUI.Other"; + } + @Override public void onChest(Player player) { if (this.user == null) { @@ -190,11 +200,7 @@ public void onChest(Player player) { inv.dontClose(); } - if (player.getUniqueId().toString().equals(user.getUUID())) { - inv.requirePermission("VotingPlugin.Commands.Vote.GUI"); - } else { - inv.requirePermission("VotingPlugin.Commands.Vote.GUI.Other"); - } + inv.requirePermission(getRequiredPermission(plugin, player, user)); inv.addPlaceholder("points", "" + user.getPoints()); inv.addPlaceholder("player", user.getPlayerName()); diff --git a/VotingPlugin/src/test/java/com/bencodez/votingplugin/commands/gui/player/VoteGUIPermissionTest.java b/VotingPlugin/src/test/java/com/bencodez/votingplugin/commands/gui/player/VoteGUIPermissionTest.java new file mode 100644 index 0000000000..fb801fb501 --- /dev/null +++ b/VotingPlugin/src/test/java/com/bencodez/votingplugin/commands/gui/player/VoteGUIPermissionTest.java @@ -0,0 +1,56 @@ +package com.bencodez.votingplugin.commands.gui.player; + +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertNotEquals; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; + +import java.util.UUID; + +import org.bukkit.entity.Player; +import org.junit.jupiter.api.Test; + +import com.bencodez.votingplugin.VotingPluginMain; +import com.bencodez.votingplugin.user.UserManager; +import com.bencodez.votingplugin.user.VotingPluginUser; + +class VoteGUIPermissionTest { + + @Test + void ownGuiUsesVotingPluginIdentityWhenOfflineUuidDiffersFromBukkitUuid() { + VotingPluginMain plugin = mock(VotingPluginMain.class); + UserManager userManager = mock(UserManager.class); + Player player = mock(Player.class); + VotingPluginUser viewingUser = mock(VotingPluginUser.class); + VotingPluginUser viewedUser = mock(VotingPluginUser.class); + UUID bukkitUuid = UUID.fromString("11111111-1111-1111-1111-111111111111"); + String offlineUuid = "22222222-2222-2222-2222-222222222222"; + + when(player.getUniqueId()).thenReturn(bukkitUuid); + when(plugin.getVotingPluginUserManager()).thenReturn(userManager); + when(userManager.getVotingPluginUser(player)).thenReturn(viewingUser); + when(viewingUser.getUUID()).thenReturn(offlineUuid); + when(viewedUser.getUUID()).thenReturn(offlineUuid); + + assertNotEquals(player.getUniqueId().toString(), viewedUser.getUUID()); + assertEquals("VotingPlugin.Commands.Vote.GUI", + VoteGUI.getRequiredPermission(plugin, player, viewedUser)); + } + + @Test + void otherPlayerGuiStillRequiresOtherPermission() { + VotingPluginMain plugin = mock(VotingPluginMain.class); + UserManager userManager = mock(UserManager.class); + Player player = mock(Player.class); + VotingPluginUser viewingUser = mock(VotingPluginUser.class); + VotingPluginUser viewedUser = mock(VotingPluginUser.class); + + when(plugin.getVotingPluginUserManager()).thenReturn(userManager); + when(userManager.getVotingPluginUser(player)).thenReturn(viewingUser); + when(viewingUser.getUUID()).thenReturn("22222222-2222-2222-2222-222222222222"); + when(viewedUser.getUUID()).thenReturn("33333333-3333-3333-3333-333333333333"); + + assertEquals("VotingPlugin.Commands.Vote.GUI.Other", + VoteGUI.getRequiredPermission(plugin, player, viewedUser)); + } +} From 4d1b7e226ad54d34d2fa4eca8d390271af0b29d5 Mon Sep 17 00:00:00 2001 From: Ben Date: Fri, 18 Sep 2026 16:18:40 -0600 Subject: [PATCH 2/2] Harden VoteGUI self permission check --- .../commands/gui/player/VoteGUI.java | 5 ++--- .../gui/player/VoteGUIPermissionTest.java | 17 +++++++++++++++++ 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/VotingPlugin/src/main/java/com/bencodez/votingplugin/commands/gui/player/VoteGUI.java b/VotingPlugin/src/main/java/com/bencodez/votingplugin/commands/gui/player/VoteGUI.java index 29f5ee1990..a1e75fe51b 100644 --- a/VotingPlugin/src/main/java/com/bencodez/votingplugin/commands/gui/player/VoteGUI.java +++ b/VotingPlugin/src/main/java/com/bencodez/votingplugin/commands/gui/player/VoteGUI.java @@ -1,7 +1,6 @@ package com.bencodez.votingplugin.commands.gui.player; import java.util.ArrayList; -import java.util.Objects; import org.bukkit.command.CommandSender; import org.bukkit.entity.Player; @@ -183,8 +182,8 @@ public void onChat(CommandSender sender) { static String getRequiredPermission(VotingPluginMain plugin, Player player, VotingPluginUser viewedUser) { VotingPluginUser viewingUser = plugin.getVotingPluginUserManager().getVotingPluginUser(player); - if (viewingUser != null && viewedUser != null - && Objects.equals(viewingUser.getUUID(), viewedUser.getUUID())) { + String viewingUuid = viewingUser == null ? null : viewingUser.getUUID(); + if (viewingUuid != null && viewedUser != null && viewingUuid.equals(viewedUser.getUUID())) { return "VotingPlugin.Commands.Vote.GUI"; } return "VotingPlugin.Commands.Vote.GUI.Other"; diff --git a/VotingPlugin/src/test/java/com/bencodez/votingplugin/commands/gui/player/VoteGUIPermissionTest.java b/VotingPlugin/src/test/java/com/bencodez/votingplugin/commands/gui/player/VoteGUIPermissionTest.java index fb801fb501..2fa4dba26f 100644 --- a/VotingPlugin/src/test/java/com/bencodez/votingplugin/commands/gui/player/VoteGUIPermissionTest.java +++ b/VotingPlugin/src/test/java/com/bencodez/votingplugin/commands/gui/player/VoteGUIPermissionTest.java @@ -37,6 +37,23 @@ void ownGuiUsesVotingPluginIdentityWhenOfflineUuidDiffersFromBukkitUuid() { VoteGUI.getRequiredPermission(plugin, player, viewedUser)); } + @Test + void nullUserUuidsNeverGrantSelfGuiPermission() { + VotingPluginMain plugin = mock(VotingPluginMain.class); + UserManager userManager = mock(UserManager.class); + Player player = mock(Player.class); + VotingPluginUser viewingUser = mock(VotingPluginUser.class); + VotingPluginUser viewedUser = mock(VotingPluginUser.class); + + when(plugin.getVotingPluginUserManager()).thenReturn(userManager); + when(userManager.getVotingPluginUser(player)).thenReturn(viewingUser); + when(viewingUser.getUUID()).thenReturn(null); + when(viewedUser.getUUID()).thenReturn(null); + + assertEquals("VotingPlugin.Commands.Vote.GUI.Other", + VoteGUI.getRequiredPermission(plugin, player, viewedUser)); + } + @Test void otherPlayerGuiStillRequiresOtherPermission() { VotingPluginMain plugin = mock(VotingPluginMain.class);