Skip to content
This repository was archived by the owner on Jul 12, 2026. It is now read-only.

NeoEssentials v1.1.1-beta — Bug Fixes, Security Patches & CORS Overhaul

Choose a tag to compare

View all tags
@XEXModz XEXModz released this 12 Apr 20:39
v1.1.1-beta
f41aa5d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

⚠️ NOTE: This is a TEST BUILD. Report any issues on the repository.

What's New in v1.1.1-beta

This is a comprehensive bug fix, security patch, and quality-of-life release based on real-world testing on an ATM10 v6.5 server with FTB Ranks installed.

Bug Fixes

  • PermissionManager null crash — Internal permission manager now always loads as a fallback when FTB Ranks is active
  • setgroup null guard — Added null check and auto-creates users not yet seen by the permission system
  • Commands not working for players — Fixed broken dispatcher check that prevented all /neoe commands from working in-game
  • /delhome and /sethome infinite confirm loop — Restructured confirmation flow to prevent looping and cooldown conflicts
  • Teleport safety on modded servers — findSafe hardcoded to false to prevent teleport failures (credit: Algid)
  • New player chat invisible — Default chat channel was local (100 block radius), changed to global. Also added vanilla fallback if chat formatting fails
  • Vanish unvanish requires rejoin — showPlayerToSpecific was empty, now properly sends tab list and entity packets
  • VanishManager null crash — Fixed same null manager pattern as PermissionSystem when FTB Ranks is active
  • Dashboard login not working — Login endpoint was ignoring passwords and only doing Minecraft player lookup. Now properly routes to password-based authentication
  • /god command crash — Argument name conflict with other mods caused crash. Renamed "target" to "playername" across all PlayerStateCommands

Security Patches

  • SQL injection — Added table name sanitization and hardened query blocklist in database browser
  • Command execution bypass — Restricted commands now always enforced server-side, removed client-side bypass flag
  • Password hashing — Replaced unsalted SHA-256 with PBKDF2 (65,536 iterations, random salt). Backwards compatible with auto-upgrade on login
  • Path traversal — Normalized backup restore path before validation to prevent ../ escape
  • CORS wildcard — Replaced hardcoded Access-Control-Allow-Origin: * across 22 locations with centralized CorsHandler that reads allowed origin from config

New

  • CorsHandler.java — Centralized CORS utility, reads from config instead of hardcoding *
  • corsAllowedOrigin config — New setting to control allowed origin for dashboard API

Testing

Tested on ATM10 v6.5, NeoForge 21.1.224, with FTB Ranks installed.

Config Note

If upgrading from a previous version, you may need to manually update your chat config:

  • Set local channel "default": false
  • Set global channel "default": true
  • Or disable local channel entirely with "enabled": false
    Then run neoe reload.

Known Issues (targeting v1.1.2)

  • AntiSpamManager null config — Split config system not loading chat config properly for anti-spam filters, spamming errors in server logs on every chat message
  • /god command argument conflict — Fixed in testing but not yet included in this release
  • Web dashboard UI untested — Security patches applied but full UI testing still pending

Development Status

Our primary focus so far has been resolving in-game issues — permission crashes, command failures, chat visibility, vanish, and god mode conflicts. The major in-game bugs have been resolved and tested on a live ATM10 v6.5+ server with FTB Ranks.

The web dashboard has received security patches (SQL injection, CORS overhaul, PBKDF2 passwords, command bypass, path traversal, login fix) but has not been fully tested through the UI yet. Dashboard functionality may have issues that haven't been discovered. Web UI testing and fixes are next on the roadmap.

Assets 3
Loading