Users are able to build ChestShops without the necessary permissions

[rcjrrjcr]

This is caused by the condition at https://github.com/Acrobot/ChestShop-3/blob/master/com/Acrobot/ChestShop/Listeners/signChange.java#L56 . You're checking for (!isPlayerAdmin && !(has ChestShop.shop.create || has ChestShop.shop.create.<id> || has ChestShop.shop.exclude.<id>)), where has <node> represents checking the user for the specified permission node. This allows players without the exclusion nodes to create chest shops, even without the creation nodes.

An example of a better condition would be ( !(isPlayerAdmin || (has ChestShop.shop.create && !(has ChestShop.shop.exclude.<id>)) || (has ChestShop.shop.create.<id>)) ), which examines restriction nodes only when the ChestShop.shop.create permission is encountered, not any of the ChestShop.shop.create. nodes.

[Acrobot]

Fixed in commit e522b33.