GHSA-j5qg-w9jg-3wg3
Inability to de-op players if listed in ops.txt with non-lowercase letters
Quick fix
GHSA-j5qg-w9jg-3wg3 — pocketmine/pocketmine-mp: upgrade to the fixed version with the command below.
composer require pocketmine/pocketmine-mp:^4.0.3Details
### Impact Originally reported in iTXTech/Genisys#1188
```txt PotterHarry98 potterharry98 ```
`deop PotterHarry98`
will remove `potterharry98` from the ops.txt but not `PotterHarry98`.
Operator permissions are checked using `Config->exists()` with `lowercase=true`, which will result in a match: https://github.com/pmmp/PocketMine-MP/blob/22bb1ce8e03dba57173debf0415390511d68e045/src/utils/Config.php#L449
This means that it's possible to make yourself impossible to de-op (using commands) by adding your name to ops.txt with uppercase letters.
### Patches 4d37b79ff7f9d9452e988387f97919a9a1c4954e
### Workarounds This can be easily addressed by removing the offending lines from ops.txt manually.
### For more information If you have any questions or comments about this advisory: * Open an issue in [pmmp/PocketMine-MP](https://github.com/pmmp/PocketMine-MP) * Email us at [team@pmmp.io](mailto:team@pmmp.io)
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 4.0.3composer require pocketmine/pocketmine-mp:^4.0.3References
- https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-j5qg-w9jg-3wg3[WEB]
- https://github.com/iTXTech/Genisys/issues/1188[WEB]
- https://github.com/pmmp/PocketMine-MP/commit/4d37b79ff7f9d9452e988387f97919a9a1c4954e[WEB]
- https://github.com/pmmp/PocketMine-MP[PACKAGE]
- https://github.com/pmmp/PocketMine-MP/blob/4.0.3/changelogs/4.0.md#403[WEB]