Skip to content

fix: critical server-side bugs in spigot module#4

Open
thehaffk wants to merge 1 commit into
devfrom
fix/server-side-bugfixes
Open

fix: critical server-side bugs in spigot module#4
thehaffk wants to merge 1 commit into
devfrom
fix/server-side-bugfixes

Conversation

@thehaffk

@thehaffk thehaffk commented Mar 1, 2026

Copy link
Copy Markdown
Member

Summary

  • Permission bypass fix: DeleteCommand now checks display ownership
  • Data corruption fix: unpackX sign extension for negative X coordinates
  • Null world crash fix: Skip displays from unloaded worlds during DB load
  • Race condition fixes: HashMap to ConcurrentHashMap in StateManager, PlayerManager, SelectionManager
  • Display limit: New max_displays_per_player config option (default: 10)
  • Blocking I/O fix: getOfflinePlayer() to getPlayer() in ListCommand/InfoCommand

Test plan

  • Create display at negative X, restart, verify position preserved
  • Verify non-owner cannot delete others displays via /display delete
  • Verify admin with dreamdisplays.delete CAN delete others displays
  • Create 10 displays, verify 11th is rejected
  • Set max_displays_per_player = 0, verify unlimited works
  • Unload a world, restart, verify no crash
  • Run /display list with offline owners, verify no TPS drops

- Fix permission bypass: DeleteCommand now checks display ownership
  before allowing deletion (non-owners need admin permission)
- Fix data corruption: unpackX sign extension for negative X coordinates
  that caused displays to appear at wrong positions after DB reload
- Fix null world crash: skip displays from unloaded worlds during DB load
  instead of propagating null Location through the system
- Fix race conditions: replace HashMap with ConcurrentHashMap in
  StateManager, PlayerManager (5 maps), and SelectionManager
- Add max_displays_per_player config (default 10) to prevent unbounded
  display creation that degrades server performance
- Fix blocking I/O: replace Bukkit.getOfflinePlayer() with getPlayer()
  in ListCommand and InfoCommand to avoid disk reads on main thread
@thehaffk
thehaffk force-pushed the fix/server-side-bugfixes branch from e613c4f to 519892e Compare March 1, 2026 16:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant