Brainstorm your ideas on how we can safely reenable nbt paste for everyone here.
I think we all want it reenabled but Ryan says nobody has thought of any good way.
Lets think of a good way here.
\/ \/
Brainstorm your ideas on how we can safely reenable nbt paste for everyone here.
I think we all want it reenabled but Ryan says nobody has thought of any good way.
Lets think of a good way here.
\/ \/
Have a script that alerts admins anytime an NBT object is pasted so we can assess immediately whether it is used to harm the server, or whether it is just someone building.
@redeastwood#15114 I'd add a threshold for number of custom objects and / or NBT size or else you'll end up full of alerts.
So something I would find very useful as well is to understand.
Do we drop the NBT Data in WorldEdit for OP's when they copy the blocks, or when they paste them? Just wondering if folks are building things and saving them as schematics if the NBT data at least is stored there, because at least then when we have fixed this issue folks will have NBT to paste?
@wild1145#15134 NBT is stored when you save your build as a schematic.
@wild1145#15134 @StevenNL2000#15145 Fleek and me saw that the permission worldedit.setnbt is not enabled, meaning that NBT can't be set on //paste operations.
Admins can do that because they have worldedit.*
What are the risks of enabling NBT paste?
@Ashaz#15149 It's mainly that you can prepare exploits instead of having to create them on the spot. For example, you can store a crash chest in a schematic to easily grab it. You might also be able to use some exploits that have already been patched, because most patches only check the player, but WorldEdit doesn't go through the player.
Still, it stinks to have all those restrictions for OPs. There's a lot of stuff that's blocked basically because somebody could abuse it and the entire playerbase (both simple OPs and blue OPs master builders) gets penalized.
Could we perhaps look into the idea of filtering tile entities in WorldEdit as they are loaded into the clipboard?
@videogamesm12#15198 I believe that runs into this problem:
Quote@Fleek#15125
VulnerabilityPatcher can’t check for WorldEdit, and if it could, it is most likely going to slow down to check each block in large edits.
WorldEdit doesn’t offer any API that we could use.
@StevenNL2000#15251 Which is a fair assessment, though I meant modify WorldEdit itself to filter through tile entities.
@videogamesm12#15252 I guess that is always a possibility, although we'll have to reimplement all our exploit patches. There are a few inside TFM itself as well.