This is a bug fix and minor feature release - Nucleus 2.4.2 for Sponge API version 7.3
This was built from Nucleus commit: 0be223b55
Release Notes
If you’re having trouble, visit our Discord channel: https://discord.gg/A9QHG5H
Kit Commands are now disabled by default
A very common question that comes up in the Nucleus support channels is “why can my players redeem kits without a cooldown?” This is invariably because server owners incorrectly assume that nucleus.kit is permission they need for accessing /kit. It is not. The permission is nucleus.kit.base.
The reason that nucleus.kit works is because in Sponge, nucleus.kit is the same as Bukkit’s nucleus.kit.*. As a result, by granting nucleus.kit you are giving players the ability to bypass cooldowns, redeem kits as many times as they like, and create kits – including command kits. These permissions are super dangerous to let anyone have. If you are running a server and you have given the nucleus.kit permission to players - whitelist your server and kick all players RIGHT NOW while you fix permissions and check for any kits that you didn’t make.
Because this is too common a problem, this update to Nucleus will disable commands in kits by default. You will need to go into the kits section of the config to re-enable them, then reload your config in the normal way. I apologise to those of you that have entered your permissions properly, however I do not want to continue seeing servers put themselves into a dangerous position because they have guessed the permissions they need to use, rather than read the docs, therefore not using the base suffix to permissions.
Please note that this defaults to false for EVERYBODY, as I want to try to catch servers that are doing this so they are protected while they fix their permissions.
General Notes
- Some plugins and mods are known to be incompatible with Nucleus. See https://v2.nucleuspowered.org/docs/compatibility.html for more information.