EssentialsX
Fix teleport permission bypass exploit
Information This PR fixes https://github.com/EssentialsX/Essentials/issues/5237
Details Players can bypass the "tpaccept" permission check when teleport delay is enabled. This can be done by an exploiter getting the target to /tpa to them, then, the exploiter starts a teleport timer to a location where they do not have "tpaccept" and then typing /tpaccept before that timer finishes. This will cause the first timer to teleport the exploiter to the location where they do not have "tpaccept" and then the timer for the target player will finish, resulting in the target teleporting to the exploiters location.
Proposed fix: Check if the target is a player, if so, check if the player has permission to accept teleports.
Environments tested: OS: Windows 10
Java version: OpenJDK Runtime Environment Temurin-17.0.3+7 (build 17.0.3+7)
- [X] Most recent Paper version (MC: 1.19.3)
- [ ] CraftBukkit/Spigot/Paper 1.12.2
- [ ] CraftBukkit 1.8.8
