[Bug]: Does not prevent Supplementaries slingshot, bombs from affecting claimed areas

[HenrikoMagnifico]

Mod

FTB Chunks

Mod version

1.20.1 2001.3.1

NeoForge / Forge / Fabric version

47.3.10

Modpack & version

No response

What issue are you having?

It seems that Supplementaries items and blocks (slingshot, bombs etc.) can bypass the protections from FTB Chunks. This results in potential griefing on servers which uses Supplementaries and has these items enabled.

Crashlogs

No response

Steps to reproduce

1. Install Supplementaries and make a protection claim using FTB Chunks.
2. Try to use a Slingshot or Bombs as another player inside of the claim.
3. Break and place blocks as you please using these items.

Anything else to note?

The authors of Supplementaries when asked about this issue responded that "they [The Slingshot and bombs] even use a fake player to place those so tbh ftb should catch that"

[desht]

Just tested this, and I cannot break other people's blocks by throwing bombs in their claims, as expected.

Have you set "Allow all Fake Players" to true in your FTB Teams settings? If you have, then you're not protected, and this is working as intended; the tooltip warning on this setting is quite clear:

WARNING: Setting this to true could allow hostile players to access your claims via any fake player. Set this to false if you're unsure.

[HenrikoMagnifico]

Just tested this, and I cannot break other people's blocks by throwing bombs in their claims, as expected.

Have you set "Allow all Fake Players" to true in your FTB Teams settings? If you have, then you're not protected, and this is working as intended; the tooltip warning on this setting is quite clear:

WARNING: Setting this to true could allow hostile players to access your claims via any fake player. Set this to false if you're unsure.

My apologies, the bombs are indeed protected with FTB Chunks, but the slingshot is not. The same goes for regular Minecraft pistons, which can still push blocks from outside a claimed chunk into it- which can also be used for griefing.

[albatrossen]

Distilled version of the bug using a minimal setup with a regular forge server and using the basegame sticky piston to show a bypass despite having fake players turned off.

I have not tested it against main branch only the 2001.3.1 version
https://github.com/user-attachments/assets/d0514308-840b-49f1-8099-5852e528b344

[desht]

The Slingshot issue is definitely a problem with Supplementaries. They do use a fake player, but that's irrelevant, because they call BlockItem#place without first firing a BlockEvent.EntityPlaceEvent to see if placement is allowed (https://github.com/MehVahdJukaar/Supplementaries/blob/master/common/src/main/java/net/mehvahdjukaar/supplementaries/common/utils/ItemsUtil.java#L55)

The piston issue looks like something we'll need to check in FTB Chunks, since it's vanilla behaviour that we should be blocking.

On further consideration, it's not really possible to prevent pistons at all, because pistons do not have any player context. Meaning that, if pistons were to be prevented from operating in claimed chunks, they'd stop working regardless of who placed them, including the claim owner. And that's not really an acceptable situation.

So pistons are just gonna have to continue working... 🤷

[albatrossen]

Do keep in mind that means ftb chunk does not protect against something like https://youtu.be/1AEG8QBG3_E or unless you cage blocks in tile entities you can steal any non tile entity from inside the protection. flooding it also give you access to all the resources.
on the bright side you cannot steal inventories since they are tile entities, and you cannot flood with lava (cannot move dispenser, which do bypass the protection for placing lava or water)

Personally I would have preferred something like any piston working across a boundary - that is a piston can only move block if all the blocks it want to move is either in an unclaimed chunk or in a chunk with the same owner as the chunk the piston is in. Contraptions would then still work inside the claim, but prevent access with flying machines etc from the outside

[desht]

Personally I would have preferred something like any piston working across a boundary - that is a piston can only move block if all the blocks it want to move is either in an unclaimed chunk or in a chunk with the same owner as the chunk the piston is in. Contraptions would then still work inside the claim, but prevent access with flying machines etc from the outside

That's actually not a bad idea, although I would extend it to allow piston access across claims if the target claim of the piston (i.e. the block 1 or 2 spaces in front) has public "edit block" access. I'll have a play with that concept, I think it wouldn't be hard to implement.

[desht]

Fixed in 2101.1.4 (for 1.21.1).

Will backport to 1.20.1 for the next release of the mod on that MC version.