Skip to content

Potential security issue #31

@ghost

Description

Checking event.getView().getTitle() to see whether your custom inventory is being used is unsafe, as renaming a chest in an anvil allows users to set their own inventory titles. The correct way to check if your custom inventory is involved with an event is by using custom holders, see here: https://docs.papermc.io/paper/dev/custom-inventory-holder

if(e.getView().getTitle().equalsIgnoreCase(Language.CATEGORY_MENU_TITLE.getMessage()))

Metadata

Metadata

Labels

enhancementNew feature or request

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions