PlugMan
PlugMan copied to clipboard
Remove direct download command
Dear plugin maintainer, I would like to suggest removing the direct download function from the plugin due to serious security issues and risk of attacks on servers.
Any person with OP permissions on the server or permissions to PlugManX can download an unverified plugin from any source and thus attack the server by loading a backdoor (I mean a plugin with code that can harm the server). This feature, in my opinion, should not be available in future versions of PlugManX. This change will increase security on servers that use PlugManX and thus prevent the previously mentioned attacks. There is no reason to remove the download feature from SpigotMC as it is a safer and verified source unlike direct download.
I hope that my request will be considered positively.
This feature is disabled by default.
Meaning, a person with OP cannot download any plugins by default
I'll think about removing it though.
The feature is usually not useful anyway
Download command is gone