Register (check).silent permission

[RoboMWM]

[15:47:11] <RoboMWM> violations are canceled, yes, but no logs/reports on me
[15:47:29] <asofold> being op is special though , in addition it may depend on what the permission plugin is doing
[15:47:44] <asofold> it could forcibly deal all permissions
[15:47:55] <asofold> by employing obscure technique
[15:48:01] <RoboMWM> it's my own, no other permission manager :P
[15:48:25] <RoboMWM> attachment.setPermission("nocheatplus.checks", false);
[15:48:25] <RoboMWM>             attachment.setPermission("nocheatplus.bypass", false);
[15:48:33] <asofold> perhaps bukkit does, depending on op-levek
[15:48:36] <asofold> *level
[15:49:04] <RoboMWM> well it seems negating nocheatplus.checks isn't enough, and the second one doesn't do anything more apparently
[15:49:10] <RoboMWM> idk what else I should be negating
[15:49:19] <asofold> e.g. pex might allow ops anyway, or the op-default rules
[15:49:24] <RoboMWM> not using PEX
[15:49:30] <asofold> kk
[15:49:34] <asofold> defualt is 'op'
[15:49:38] <asofold>  perhaops its that then
[15:53:06] <RoboMWM> where does NCP decide when to log
[15:53:40] <asofold> on violations
[15:54:00] <asofold> perhaps its the .silent permission
[15:54:15] <RoboMWM> oh, never saw that in plugin.yml
[15:54:19] <asofold> theyre not initialized explicitly
[15:54:24] <asofold> but checked implicitly
[15:54:35] <asofold> thus the hierarchy wouldn't count
[15:55:10] <asofold> so their actions get canceled , but it doesn't log ?
[15:55:14] <RoboMWM> yes
[15:55:26] <asofold>  ok - then it looks lik the .silent part
[15:55:34] <asofold> wharteverpermissio.silent
[15:55:40] <asofold> a design flaw on wichever side
[15:55:48] <RoboMWM> idk if you want to add that to the wiki or something
[15:55:55] <asofold> m
[15:56:00] <RoboMWM> so, nocheatplus.silent? or nocheatplus.checks.silent
[15:56:05] <asofold> worth an issue in theory 
[15:56:08] <RoboMWM> or do I have to do this for each one
[15:56:19] <asofold> specificcheckperm.silent
[15:56:36] <asofold> e.g. nocheatplus.checks.moving.player.survivalfly.silent
[15:56:50] <asofold> not nice to do in general ...
[15:56:56] <RoboMWM> fun
[15:57:13] <asofold> probably should be registered with parent permissions earlier on, instead
[15:57:27] <asofold> it's been like that since ... start of things
[15:57:33] <RoboMWM> Want me to make an issue and copy this conversation to it?
[15:57:54] <asofold> sure, if you are free to do it, just copy and paste

[asofold]

Build 1048 is supposed to fix this.

[RoboMWM]

Running build 1054, it seems it's still applying the .silent perm to me when I'm op, despite negating nocheatplus.checks

[asofold]

I overlooked one point:

• Are you using java code to set the permissions?

NCP will update the permissions in the first server tick (scheduled task!), after plugins enabled. Not sure this makes such a difference but technically it's different to set the permission default to false, than to deny the permission for indivudual players.

Another thing, ave ou considered also changing the following permissions?

• nocheatplus.shortcut
• nocheatplus.admin

The defaults of the summarizizing permissions should be set to false, actually, OP is meant to have effect on the original permissions already, for another point to make for myself.

[RoboMWM]

Well, as op, I'd like access to the /ncp commands, but would also still want to be subjected to the checks.

That code I mentioned in the chat is run in the join handler. And yes, using Java code to set "negative" permissions. I'm not aware of any other way to "deny" a permission for a player other than what I mentioned?

[asofold]

Major

• Did you try to remove nocheatplus.admin and nocheatplus.shortcut as well? Commands should still be there for ops anyway.

Minor

• NCP might store some permissions internally on join at lowest priority (asynchronously run checks, notify) - you could ensure to run earlier with "loadbefore: NoCheatPlus" for your permissions plugin, so the join listener will come before NCP on lowest priority.
• I once used this method: https://github.com/asofold/RSP/blob/master/src/me/asofold/bpl/rsp/permissions/PermissionUtil.java#L150 It was there to avoid recalculation with every permission added, but that shouldn't make a difference after all.

Might have to reproduce and see what's happening.

[RoboMWM]

Did you try to remove nocheatplus.admin and nocheatplus.shortcut as well? Commands should still be there for ops anyway.

No I haven't. Are you implying that NCP also checks for op instead of just the permission for NCP-related commands?

NCP might store some permissions internally on join at lowest priority (asynchronously run checks, notify) - you could ensure to run earlier with "loadbefore: NoCheatPlus" for your permissions plugin, so the join listener will come before NCP on lowest priority.

Ah, I listen at low priority. I'll try this.

[asofold]

NCP doesn't check for players being op, it just relies on what is supposed to be registered.

If you negate a permission, another permission could re-enable having that permission.
Example:

1. Negate silent permission.
2. A "summary permission" contains the permission.

In Bukkit you can't reliably override a given permission, Bukkit does not know permission priorities ( - which is why i had priorities implemented in the plugin RegionSpecificPermission). So it's still possible that the permission is given by another permission that would grant it as a child permission.

• That being said, you should deny all those permissions, and re-allow those you want to be given.
• I'll push a build with the corrected default child state for the .silent permissions (they're meant not to be there, unless you give them one by one - this isn't such a cool concept after all, having no global .silent override, so i might remove them one day, for now i'll adapt it to be the typical behavior.)

[asofold]

EDIT/scissors-cut:

Latest dev build counts.

[asofold]

Does this work now?

[RoboMWM]

Sorry, just had time to test now. Unfortunately, it does not with NCP build 1057 (with no changes on my end though). Still only receiving messages about myself when deopp'd.

[asofold]

Alright.

• You have negated all relevant permissions on root level for the players? I'm thinking of the shortcut parts, admin part, checks, bypass, such?
• The other question is in this state - do they have the silent permission or do they have the check bypass permissions still?

I need to rework all the permission defaults in the plugin.yml too, in order to make removing permissions for ops easy. ~ So only one/two permissions need to be negated, e.g. a shortcut nocheatplus.op .

[RoboMWM]

(with no changes on my end though)

Means I haven't done anything other than what I stated in this issue. So I haven't tried anything else yet. I'll get to it this weekend, hopefully.

[asofold]

Could be this is better with build 1082. Looks like there has been (check).silent.silent permissions assumed before that build.

[asofold]

ASsume fixed - can'T be sure though.

[RoboMWM]

Sorry, I've been busy - if someone reminds me to test after a couple weeks from now I'll be able to.

[asofold]

Now in plugin.yml.