Skip to content

Players can place cushions in other players' protected regions on Minecraft 26.3 (WorldGuard 7.0.20) #2317

Closed

Description

@strobil

WorldEdit Version

Full version output not captured in this report.

WorldGuard Version

7.0.20

Platform Version

Minecraft 26.3. The exact server build is not included in this report.

Bug Description

Players can place cushions inside another player's protected WorldGuard region, despite not being an owner or member and not having permission to build there.

The cushion protection added in #2315 covers breaking existing cushions, but placement appears to remain unprotected.

Expected Behavior

Placing a cushion should respect the region's build protection. A player who cannot build in a region should not be able to place cushions there, while authorized owners and members should still be able to place them.

Reproduction Steps

  1. Use Minecraft 26.3 with WorldGuard 7.0.20 and a compatible WorldEdit version.
  2. Create a protected region owned by player A, with ordinary build protection and no explicit build allowance for outsiders.
  3. Join as player B, who is not an owner or member, is not an operator, and has no WorldGuard bypass permission.
  4. Confirm that player B cannot place ordinary blocks in the region.
  5. As player B, attempt to place a cushion inside the region.
  6. The reported result is that the cushion can be placed despite the region's build protection.

Optional WorldGuard-Report

Not attached.

Anything Else?

Source inspection of the 7.0.20 release (0b6c3f1) shows that EventAbstractionListener.handleBlockRightClick handles placement of minecarts, boats, armor stands, end crystals, and spawn eggs, but has no cushion placement branch:

https://github.com/EngineHub/WorldGuard/blob/0b6c3f1/worldguard-bukkit/src/main/java/com/sk89q/worldguard/bukkit/listener/EventAbstractionListener.java#L1245-L1304

This looks like a missing placement-to-region-protection path, separate from the entity break handling added by #2315.

The gameplay behavior is reported by the server operator; an independent clean-server reproduction and complete version/report outputs are not attached. The source observation above is independently checked.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions