Skip to content

Check teleport permission before teleporting in /tpworld - #246

Open
Smorki wants to merge 1 commit into
Maxlego08:developfrom
Smorki:fix-tp-world-permission-bypass
Open

Check teleport permission before teleporting in /tpworld#246
Smorki wants to merge 1 commit into
Maxlego08:developfrom
Smorki:fix-tp-world-permission-bypass

Conversation

@Smorki

@Smorki Smorki commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

The /tpworld <world> [player] command teleports the target player before checking the essentials.tp.world.other permission.

This means a player with only essentials.tp.world (but not .other) can still teleport other players to any world — they just get a NO_PERMISSION message after the teleport has already happened.

Steps to reproduce:

  1. Give a player essentials.tp.world but NOT essentials.tp.world.other
  2. Run /tpworld world_nether OtherPlayer
  3. OtherPlayer is teleported to the nether, sender sees "no permission"

Fix: move the permission check above the teleportAsync call, so unauthorized senders are rejected before the teleport is triggered.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant