From 587e710d12123ddd0f4826d8db8e1cba49ea44f1 Mon Sep 17 00:00:00 2001 From: zzzzzyc Date: Fri, 18 Sep 2026 21:22:03 +0800 Subject: [PATCH] Require essentials.whois.location to view coordinates in /whois Fixes the information disclosure half of #6626: /whois sent exact player coordinates to anyone holding essentials.whois. A new essentials.whois.location node now guards the location line, matching the existing essentials.seen.location design. Console and non-player senders are unaffected. --- .../java/com/earth2me/essentials/commands/Commandwhois.java | 4 +++- Essentials/src/main/resources/plugin.yml | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/Essentials/src/main/java/com/earth2me/essentials/commands/Commandwhois.java b/Essentials/src/main/java/com/earth2me/essentials/commands/Commandwhois.java index 36565746ad..df683c1976 100644 --- a/Essentials/src/main/java/com/earth2me/essentials/commands/Commandwhois.java +++ b/Essentials/src/main/java/com/earth2me/essentials/commands/Commandwhois.java @@ -39,7 +39,9 @@ public void run(final Server server, final CommandSource sender, final String co sender.sendTl("whoisHealth", user.getBase().getHealth()); sender.sendTl("whoisHunger", user.getBase().getFoodLevel(), user.getBase().getSaturation()); sender.sendTl("whoisExp", SetExpFix.getTotalExperience(user.getBase()), user.getBase().getLevel()); - sender.sendTl("whoisLocation", user.getLocation().getWorld().getName(), user.getLocation().getBlockX(), user.getLocation().getBlockY(), user.getLocation().getBlockZ()); + if (sender.isAuthorized("essentials.whois.location")) { + sender.sendTl("whoisLocation", user.getLocation().getWorld().getName(), user.getLocation().getBlockX(), user.getLocation().getBlockY(), user.getLocation().getBlockZ()); + } final long playtimeMs = System.currentTimeMillis() - (user.getBase().getStatistic(PLAY_ONE_TICK) * 50L); sender.sendTl("whoisPlaytime", DateUtil.formatDateDiff(playtimeMs)); if (!ess.getSettings().isEcoDisabled()) { diff --git a/Essentials/src/main/resources/plugin.yml b/Essentials/src/main/resources/plugin.yml index 68496ebbbd..f26644266a 100644 --- a/Essentials/src/main/resources/plugin.yml +++ b/Essentials/src/main/resources/plugin.yml @@ -1401,6 +1401,8 @@ permissions: description: Allows access to the /whois command essentials.whois.ip: description: Allows access to the /whois command with IP address + essentials.whois.location: + description: Allows access to the /whois command with location essentials.workbench: description: Allows access to the /workbench command essentials.anvil: