PocketMine-MP
PocketMine-MP copied to clipboard
Missing verification of crafting menu type for crafting items
Issue description
Currently crafting transactions verify only that you have the correct inputs and that the correct outputs were produced. It does not verify that the selected recipe is actually craftable using the available crafting menu.
This means that:
- 3x3 recipes can be crafted using a 2x2 grid
- Stonecutter recipes can be crafted without a stonecutter
This is not a very harmful exploit, but it needs to be addressed.
OS and versions
- PocketMine-MP: 4.3.2
As far as I know, this can be done by checking which window(or window id) the player has open.