Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -595,7 +595,7 @@ private void handleVoteBroadcast(JsonEnvelope msg) {
boolean online = fields.containsKey(VotingPluginWire.K_WAS_ONLINE)
? Boolean.parseBoolean(fields.get(VotingPluginWire.K_WAS_ONLINE)) : user.isOnline();
plugin.getBroadcastHandler().broadcastVote(user.getJavaUUID(), user.getPlayerName(),
voteSite.getDisplayNameForFormatting(), online, totals);
voteSite.getDisplayName(), online, totals);
}

private WireVoteResult handleWireVoteDelayRejected(JsonEnvelope msg) {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ public void onDialog(Player player) {
continue;
}

dialog.placeholder("sitename", site.getDisplayNameForFormatting()).button(site.getDisplayNameForFormatting(),
dialog.placeholder("sitename", site.getDisplayName()).button(site.getDisplayName(),
user.voteCommandLastLine(site), payload -> {

if (plugin.getGui().isChestVoteLastClickableLinks()) {
Expand All @@ -83,7 +83,7 @@ public void onDialog(Player player) {

HashMap<String, String> placeholders = new HashMap<String, String>();
placeholders.put("voteurl", site.getVoteURL());
placeholders.put("sitename", site.getDisplayNameForFormatting());
placeholders.put("sitename", site.getDisplayName());
placeholders.put("player", clicked.getName());

clickedUser.sendMessage(plugin.getGui().getChestVoteURLURLText(), placeholders);
Expand Down Expand Up @@ -121,7 +121,7 @@ public void onChest(Player player) {
for (VoteSite site : plugin.getVoteSiteManager().getVoteSitesEnabled()) {
if (!site.isHidden()) {
inv.addButton(inv.getNextSlot(),
new UpdatingBInventoryButton(plugin, site.getItem().setName(site.getDisplayNameForFormatting())
new UpdatingBInventoryButton(plugin, site.getItem().setName(site.getDisplayName())
.setLore(user.voteCommandLastGUILine(site)).setAmountNone(1), 1000, 1000) {

@Override
Expand All @@ -139,7 +139,7 @@ public void onClick(ClickEvent event) {
plugin.getGui()
.getChestVoteURLURLText(),
"voteurl", site.getVoteURL()),
"sitename", site.getDisplayNameForFormatting()),
"sitename", site.getDisplayName()),
"player", player.getName()));

}
Expand All @@ -148,7 +148,7 @@ public void onClick(ClickEvent event) {

@Override
public ItemBuilder onUpdate(Player p) {
return site.getItem().setName(site.getDisplayNameForFormatting())
return site.getItem().setName(site.getDisplayName())
.setLore(user.voteCommandLastGUILine(site)).setAmountNone(1);
}
});
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ public ArrayList<String> getChat(CommandSender sender) {

msgLine = MessageAPI.replaceIgnoreCase(msgLine, "%info%", user.voteCommandNextInfo(voteSite));

msgLine = MessageAPI.replaceIgnoreCase(msgLine, "%SiteName%", voteSite.getDisplayNameForFormatting());
msgLine = MessageAPI.replaceIgnoreCase(msgLine, "%SiteName%", voteSite.getDisplayName());
msg.add(MessageAPI.colorize(msgLine));
}
}
Expand All @@ -81,10 +81,10 @@ public void onDialog(Player player) {
String siteNameDisplay = plugin.getGui().getChestVoteNextCustomSiteNamesDisplays(site.getKey());

if (siteNameDisplay.isEmpty()) {
siteNameDisplay = site.getDisplayNameForFormatting();
siteNameDisplay = site.getDisplayName();
}

dialog.placeholder("sitename", site.getDisplayNameForFormatting()).placeholder("SiteName", site.getDisplayNameForFormatting())
dialog.placeholder("sitename", site.getDisplayName()).placeholder("SiteName", site.getDisplayName())
.placeholder("info", user.voteCommandNextInfo(site))
.button(siteNameDisplay, user.voteCommandNextInfo(site), payload -> {

Expand Down Expand Up @@ -117,7 +117,7 @@ public void onBook(Player player) {
if (!site.isHidden()) {
Layout nextLayout = new Layout(new ArrayList<>(Arrays.asList("[Json]")));
nextLayout.replaceTextComponent("[Json]",
BookUtil.TextBuilder.of(book.colorize(site.getDisplayNameForFormatting()))
BookUtil.TextBuilder.of(book.colorize(site.getDisplayName()))
.onClick(BookUtil.ClickAction.openUrl(site.getVoteURLJsonStrip()))
.onHover(BookUtil.HoverAction.showText(user.voteCommandNextInfo(site))).build());
book.addLayout(nextLayout);
Expand All @@ -141,7 +141,7 @@ public void onChest(Player player) {
if (!site.isHidden()) {
String siteNameDisplay = plugin.getGui().getChestVoteNextCustomSiteNamesDisplays(site.getKey());
if (siteNameDisplay.isEmpty()) {
siteNameDisplay = site.getDisplayNameForFormatting();
siteNameDisplay = site.getDisplayName();
}
inv.addButton(inv.getNextSlot(),
new UpdatingBInventoryButton(plugin,
Expand All @@ -159,7 +159,7 @@ public void onClick(ClickEvent clickEvent) {

@Override
public ItemBuilder onUpdate(Player player) {
return site.getItem().setName(site.getDisplayNameForFormatting())
return site.getItem().setName(site.getDisplayName())
.setLore(user.voteCommandNextInfo(site)).setAmountNone(1)
.addPlaceholder("player", user.getPlayerName());
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -52,9 +52,9 @@ public void onDialog(Player player) {
final UUID uuid = topPlayer.getUuid();

dialog.placeholder("player", topPlayer.getPlayerName()).placeholder("votesite", voteSite.getKey())
.placeholder("sitename", voteSite.getDisplayNameForFormatting())
.placeholder("SiteName", voteSite.getDisplayNameForFormatting())
.placeholder("VoteSite", voteSite.getDisplayNameForFormatting()).placeholder("time", timeString)
.placeholder("sitename", voteSite.getDisplayName())
.placeholder("SiteName", voteSite.getDisplayName())
.placeholder("VoteSite", voteSite.getDisplayName()).placeholder("time", timeString)
.placeholder("Time", timeString).button("&e" + topPlayer.getPlayerName(),
plugin.getConfigFile().getFormatCommandsVoteTodayLine(), payload -> {
Player clicked = player.getServer().getPlayer(payload.owner());
Expand Down Expand Up @@ -136,9 +136,9 @@ public void onChest(Player player) {
HashMap<String, String> placeholders = new HashMap<>();
placeholders.put("player", user.getPlayerName());
placeholders.put("votesite", voteSite.getKey());
placeholders.put("sitename", voteSite.getDisplayNameForFormatting());
placeholders.put("SiteName", voteSite.getDisplayNameForFormatting());
placeholders.put("VoteSite", voteSite.getDisplayNameForFormatting());
placeholders.put("sitename", voteSite.getDisplayName());
placeholders.put("SiteName", voteSite.getDisplayName());
placeholders.put("VoteSite", voteSite.getDisplayName());
placeholders.put("time", timeString);
placeholders.put("Time", timeString);

Expand Down Expand Up @@ -204,7 +204,7 @@ public String[] voteToday() {
HashMap<String, String> placeholders = new HashMap<>();
placeholders.put("player", user.getPlayerName());
placeholders.put("votesite", voteSite.getKey());
placeholders.put("sitename", voteSite.getDisplayNameForFormatting());
placeholders.put("sitename", voteSite.getDisplayName());
placeholders.put("time", timeString);
msg.add(PlaceholderUtils.replacePlaceHolder(plugin.getConfigFile().getFormatCommandsVoteTodayLine(),
placeholders));
Expand Down Expand Up @@ -234,7 +234,7 @@ public String[] voteTodayGUI() {
HashMap<String, String> placeholders = new HashMap<>();
placeholders.put("player", user.getPlayerName());
placeholders.put("votesite", mostRecentSite.getKey());
placeholders.put("sitename", mostRecentSite.getDisplayNameForFormatting());
placeholders.put("sitename", mostRecentSite.getDisplayName());
placeholders.put("time", timeString);
msg.add(PlaceholderUtils.replacePlaceHolder(plugin.getConfigFile().getFormatCommandsVoteTodayLine(),
placeholders));
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ public ArrayList<String> getChat(CommandSender sender, boolean bypassCanVote) {
plugin.getConfigFile().getFormatCommandsVoteURLS());
message.replacePlaceholder("num", Integer.toString(counter))
.replacePlaceholder("url", voteURL)
.replacePlaceholder("SiteName", voteSite.getDisplayNameForFormatting());
.replacePlaceholder("SiteName", voteSite.getDisplayName());
if (user != null && user.getPlayerName() != null) {
message.replacePlaceholder("player", "" + user.getPlayerName())
.replacePlaceholder("Next", "" + user.voteCommandNextInfo(voteSite));
Expand Down Expand Up @@ -150,14 +150,14 @@ public void onDialog(Player player) {
boolean canVote = finalUser.canVoteSite(voteSite);
String color = canVote ? "&a" : "&c";

dialog.placeholder("sitename", voteSite.getDisplayNameForFormatting())
.placeholder("SiteName", voteSite.getDisplayNameForFormatting())
.placeholder("servicesite", voteSite.getServiceSiteForFormatting())
.placeholder("ServiceSite", voteSite.getServiceSiteForFormatting())
dialog.placeholder("sitename", voteSite.getDisplayName())
.placeholder("SiteName", voteSite.getDisplayName())
.placeholder("servicesite", voteSite.getServiceSite())
.placeholder("ServiceSite", voteSite.getServiceSite())
.placeholder("VoteDelay", "" + voteSite.getVoteDelay())
.placeholder("VoteHour", "" + voteSite.getVoteDelayDailyHour())
.placeholder("Next", finalUser.voteCommandNextInfo(voteSite))
.button(color + voteSite.getDisplayNameForFormatting(),
.button(color + voteSite.getDisplayName(),
canVote ? "&aClick to view vote link" : "&c" + finalUser.voteCommandNextInfo(voteSite),
payload -> {
Player clicked = player.getServer().getPlayer(payload.owner());
Expand All @@ -166,9 +166,9 @@ public void onDialog(Player player) {
.getVotingPluginUser(clicked);
HashMap<String, String> placeholders = new HashMap<String, String>();
placeholders.put("voteurl", voteSite.getVoteURL());
placeholders.put("sitename", voteSite.getDisplayNameForFormatting());
placeholders.put("sitename", voteSite.getDisplayName());
placeholders.put("player", clicked.getName());
placeholders.put("servicesite", voteSite.getServiceSiteForFormatting());
placeholders.put("servicesite", voteSite.getServiceSite());
placeholders.put("VoteDelay", "" + voteSite.getVoteDelay());
placeholders.put("VoteHour", "" + voteSite.getVoteDelayDailyHour());
clickedUser.sendMessage(plugin.getGui().getChestVoteURLURLText(), placeholders);
Expand Down Expand Up @@ -218,8 +218,8 @@ private ItemBuilder getItemVoteSite(VoteSite voteSite) {
builder.setName(plugin.getGui().getChestVoteURLGUISiteName());
builder.addLoreLine(plugin.getGui().getChestVoteURLNextVote());
}
builder.addPlaceholder("ServiceSite", voteSite.getServiceSiteForFormatting());
builder.addPlaceholder("Name", voteSite.getDisplayNameForFormatting());
builder.addPlaceholder("ServiceSite", voteSite.getServiceSite());
builder.addPlaceholder("Name", voteSite.getDisplayName());
builder.addPlaceholder("VoteDelay", "" + voteSite.getVoteDelay());
builder.addPlaceholder("VoteHour", "" + voteSite.getVoteDelayDailyHour());
builder.addPlaceholder("Info", user.voteCommandNextInfo(voteSite));
Expand All @@ -240,7 +240,7 @@ public void onBook(Player player) {
if (!site.isHidden()) {
if (site.getPermissionToView().isEmpty() || player.hasPermission(site.getPermissionToView())) {
Layout layout = new Layout(plugin.getGui().getBookVoteURLBookGUILayout())
.addPlaceholder("sitename", site.getDisplayNameForFormatting()).addPlaceholder("num", "" + i);
.addPlaceholder("sitename", site.getDisplayName()).addPlaceholder("num", "" + i);
String text = plugin.getGui().getBookVoteURLBookGUIAlreadyVotedText();
ChatColor color = ChatColor.valueOf(plugin.getGui().getBookVoteURLBookGUIAlreadyVotedColor());
if (user.canVoteSite(site)) {
Expand Down Expand Up @@ -342,9 +342,9 @@ public void onClick(ClickEvent event) {
VotingPluginUser user = plugin.getVotingPluginUserManager().getVotingPluginUser(player);
HashMap<String, String> placeholders = new HashMap<>();
placeholders.put("voteurl", voteSite.getVoteURL());
placeholders.put("sitename", voteSite.getDisplayNameForFormatting());
placeholders.put("sitename", voteSite.getDisplayName());
placeholders.put("player", player.getName());
placeholders.put("servicesite", voteSite.getServiceSiteForFormatting());
placeholders.put("servicesite", voteSite.getServiceSite());
placeholders.put("VoteDelay", "" + voteSite.getVoteDelay());
placeholders.put("VoteHour", "" + voteSite.getVoteDelayDailyHour());
user.sendMessage(plugin.getGui().getChestVoteURLURLText(), placeholders);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ public void onChest(Player player) {
}
VoteSite site = plugin.getVoteSiteManager().getVoteSite(voteSite, true);
BInventory inv = new BInventory(plugin.getGui().getChestVoteURLSiteName());
inv.addPlaceholder("site", site.getDisplayNameForFormatting());
inv.addPlaceholder("site", site.getDisplayName());
inv.setMeta(player, "VoteSite", site);
if (!plugin.getConfigFile().isAlwaysCloseInventory()) {
inv.dontClose();
Expand Down Expand Up @@ -117,10 +117,10 @@ public void onDialog(Player player) {
VoteSite site = plugin.getVoteSiteManager().getVoteSite(voteSite, true);

com.bencodez.simpleapi.dialog.MultiActionDialogBuilder dialog = plugin.getDialogService().multiAction(player)
.placeholder("player", user.getPlayerName()).placeholder("site", site.getDisplayNameForFormatting())
.placeholder("sitename", site.getDisplayNameForFormatting()).placeholder("SiteName", site.getDisplayNameForFormatting())
.placeholder("servicesite", site.getServiceSiteForFormatting())
.placeholder("ServiceSite", site.getServiceSiteForFormatting())
.placeholder("player", user.getPlayerName()).placeholder("site", site.getDisplayName())
.placeholder("sitename", site.getDisplayName()).placeholder("SiteName", site.getDisplayName())
.placeholder("servicesite", site.getServiceSite())
.placeholder("ServiceSite", site.getServiceSite())
.placeholder("VoteDelay", "" + site.getVoteDelay())
.placeholder("VoteHour", "" + site.getVoteDelayDailyHour())
.placeholder("Next", user.voteCommandNextInfo(site)).placeholder("Last", user.voteCommandLastLine(site))
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,7 @@ private boolean tryGenerateVoteSite(String siteName, boolean automatic) {
setVoteDelay(siteName, "24h");
set(siteName, "DisplayItem.Material", "STONE");
set(siteName, "DisplayItem.Amount", 1);
set(siteName, "Rewards.Messages.Player", "&aThanks for voting on %SiteName%!");
set(siteName, "Rewards.Messages.Player", "&aThanks for voting on %ServiceSite%!");
set(siteName, "WaitUntilVoteDelayRewards", Collections.emptyMap());

plugin.loadVoteSites();
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -280,7 +280,6 @@ public void onCoolDownEnd(PlayerVoteCoolDownEndEvent event) {
public void onCoolDownEnd(PlayerVoteSiteCoolDownEndEvent event) {
plugin.getRewardHandler().giveReward(event.getPlayer(), event.getSite().getSiteData(), "CoolDownEndRewards",
new RewardOptions().addPlaceholder("sitename", event.getSite().getDisplayName())
.addDisplayPlaceholder("sitename", event.getSite().getDisplayNameForFormatting())
.addPlaceholder("url", event.getSite().getVoteURL(false)));
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@ private BukkitOperations(VotingPluginMain plugin, PlayerVoteEvent event) {
}
@Override public boolean siteEnabled(VoteSite site) { return site.isEnabled(); }
@Override public String siteKey(VoteSite site) { return site.getKey(); }
@Override public String siteDisplayName(VoteSite site) { return site.getDisplayNameForFormatting(); }
@Override public String siteDisplayName(VoteSite site) { return site.getDisplayName(); }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep untrusted service names inert during formatting

When AutoCreateVoteSites is enabled (the shipped default), a Votifier sender can supply an otherwise-valid service such as %player_ip%, which becomes the generated site's fallback display name. Returning that raw value here lets BroadcastFormat insert it into %site%, after which BroadcastHandler.broadcastNow runs PlaceholderUtils.replacePlaceHolders, turning attacker-controlled service text into a second-pass PlaceholderAPI expression; installed expansions may therefore disclose data or perform expansion-specific effects instead of displaying the service literally. Preserve the inert display value for broadcasts and other rendering paths while retaining the raw identifier only for matching and action placeholders.

AGENTS.md reference: AGENTS.md:L7-L9

Useful? React with 👍 / 👎.

@Override public VotingPluginUser resolveUser(String name) {
if (event.getVotingPluginUser() != null) return event.getVotingPluginUser();
Player player = Bukkit.getPlayerExact(name);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@
import com.bencodez.votingplugin.proxy.VotingPluginProxyConfig;
import com.bencodez.votingplugin.proxy.VotingPluginProxy.VoteRetryException;
import com.bencodez.votingplugin.util.MinecraftUsernameValidator;
import com.bencodez.votingplugin.util.ServiceSiteValidator;
import com.bencodez.votingplugin.timequeue.VoteTimeQueue;

import lombok.Getter;
Expand Down Expand Up @@ -676,7 +677,7 @@ private void processPendingIncomingVote(PendingIncomingVote pending) {
}
if (result == IncomingVoteRuntimeResult.PROCESSED) {
getLogger().info("Vote received " + MinecraftUsernameValidator.sanitizeForLog(pending.getPlayer())
+ " from service site " + MinecraftUsernameValidator.sanitizeForLog(pending.getService()));
+ " from service site " + ServiceSiteValidator.sanitizeForLog(pending.getService()));
return;
}
if (result == IncomingVoteRuntimeResult.RETRY_AFTER_RELOAD) {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@
import com.bencodez.votingplugin.proxy.VotingPluginProxyConfig;
import com.bencodez.votingplugin.proxy.VotingPluginProxy.VoteRetryException;
import com.bencodez.votingplugin.util.MinecraftUsernameValidator;
import com.bencodez.votingplugin.util.ServiceSiteValidator;
import com.bencodez.votingplugin.timequeue.VoteTimeQueue;
import com.google.inject.Inject;
import com.velocitypowered.api.command.CommandMeta;
Expand Down Expand Up @@ -562,7 +563,7 @@ private void processPendingIncomingVote(PendingIncomingVote pending) {
}
if (result == IncomingVoteRuntimeResult.PROCESSED) {
logger.info("Vote received " + MinecraftUsernameValidator.sanitizeForLog(pending.getPlayer())
+ " from service site " + MinecraftUsernameValidator.sanitizeForLog(pending.getService()));
+ " from service site " + ServiceSiteValidator.sanitizeForLog(pending.getService()));
return;
}
if (result == IncomingVoteRuntimeResult.RETRY_AFTER_RELOAD) {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2976,7 +2976,7 @@ public String voteCommandLastGUILine(VoteSite voteSite) {

HashMap<String, String> placeholders = new HashMap<>();
placeholders.put("time", timeString);
placeholders.put("SiteName", voteSite.getDisplayNameForFormatting());
placeholders.put("SiteName", voteSite.getDisplayName());
placeholders.put("timesince", timeSince);

return PlaceholderUtils.replacePlaceHolder(plugin.getGui().getChestVoteLastLine(), placeholders);
Expand All @@ -2994,7 +2994,7 @@ public String voteCommandLastLine(VoteSite voteSite) {

HashMap<String, String> placeholders = new HashMap<>();
placeholders.put("time", timeString);
placeholders.put("SiteName", voteSite.getDisplayNameForFormatting());
placeholders.put("SiteName", voteSite.getDisplayName());
placeholders.put("timesince", timeSince);

return PlaceholderUtils.replacePlaceHolder(plugin.getConfigFile().getFormatCommandsVoteLastLine(),
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@
import org.bukkit.event.Listener;
import org.bukkit.event.player.PlayerQuitEvent;

import com.bencodez.advancedcore.api.rewards.RewardDisplayPlaceholders;
import com.bencodez.advancedcore.listeners.AdvancedCoreLoginEvent;
import com.bencodez.votingplugin.VotingPluginMain;
import com.bencodez.votingplugin.events.PlayerPostVoteEvent;
Expand Down Expand Up @@ -38,8 +37,7 @@ public VoteRemindersListener(VotingPluginMain plugin) {
*/
@EventHandler(ignoreCancelled = true, priority = EventPriority.MONITOR)
public void onPostVote(PlayerPostVoteEvent event) {
plugin.getVoteRemindersManager().onVoteCast(event.getUser(), event.getVoteSite().getDisplayName(),
event.getVoteSite().getDisplayNameForFormatting());
plugin.getVoteRemindersManager().onVoteCast(event.getUser(), event.getVoteSite().getDisplayName());
}

/**
Expand Down Expand Up @@ -84,7 +82,6 @@ public void onCoolDownEnd(PlayerVoteCoolDownEndEvent event) {
public void onCoolDownEnd(PlayerVoteSiteCoolDownEndEvent event) {
HashMap<String, String> placeholders = new HashMap<>();
placeholders.put("votesite", event.getSite().getDisplayName());
RewardDisplayPlaceholders.put(placeholders, "votesite", event.getSite().getDisplayNameForFormatting());
placeholders.put("votesite_id", event.getSite().getKey());
plugin.getVoteRemindersManager().onCooldownTrigger(event.getPlayer(), VoteReminderType.COOLDOWN_END_ANY_SITE,
placeholders);
Expand Down
Loading
Loading