BungeeResourcePack disconnecting users on login due to resource pack packet exploitation attempt about resourcepacksplugins HOT 7 CLOSED

@BillyGalbreath Incompatibility caused by Purpur?
https://github.com/pl3xgaming/Purpur/blob/0d0caaa91ffa3c51603d51ebb8fbe735ca6313d2/patches/server/0019-Player-invulnerabilities.patch#L92-L98

PurpurMC/Purpur@c64af87

from resourcepacksplugins.

Imo. Purpur should provide an option for that protection. Fixing this in the plugin wouldn't be trivial and would require something like preventing that the status packets gets sent through the Bungee. (Something some people might even want so it would need an option too)

Also generally speaking I'm a bit sceptical why that check is even necessary in the server directly. Plugins that care about that case can easily handle that exact logic themselves and not trigger when they didn't send a pack.

from resourcepacksplugins.

Sorry about that. That feature was definitely supposed to be behind a config option. This has been rectified in build 1287.

As for why we do this check @Phoenix616 its because Purpur has the option to put a player into invulnerable mode while they are accepting/downloading a server resource pack. This check was put into place to prevent modded clients from abusing this feature to gain unlimited vulnerability. You can send the resource pack through ServerPlayer#sendTexturePack or manually set Purpur's ServerPlayer#acceptingResourcePack flag to make this plugin compatible with this feature.

@mibby Make sure you disable the player.invulnerable-while-accepting-resource-pack option in purpur.yml until this plugin becomes compatible with the feature.

from resourcepacksplugins.

from resourcepacksplugins.

Well that's not really possible in that case as the plugin sends the pack from the proxy :)

Shouldn't the plugin on the proxy swallow the responses then?

from resourcepacksplugins.

from resourcepacksplugins.

Closing this seeing as there now is a work around (even though it might not be ideal in most situations).

As for why we do this check @Phoenix616 its because Purpur has the option to put a player into invulnerable mode while they are accepting/downloading a server resource pack. This check was put into place to prevent modded clients from abusing this feature to gain unlimited vulnerability.

Out of curiosity though: Why are you not freezing the player when the pack request is sent instead of when the ACCEPTED response comes? Wouldn't only freezing directly on send prevent the possibility for the exploit completely (and also ensure a bit more that the player doesn't get damaged as the server doesn't have to wait for the response)?

from resourcepacksplugins.