From d29715e9ad426154b42238ec10ccab13602b0f9e Mon Sep 17 00:00:00 2001 From: Hornwitser Date: Sun, 5 Feb 2023 23:30:08 +0100 Subject: [PATCH] Allow players to list users by default The rationale for not allowing players to list users in the cluster by default was that this would be an information disclosure of banned users in the cluster, but given that a player is a user that can connect to a server, and anyone that can connect to a server get the full banlist from the server during the connection phase this does not make much sense. Grant permission to list users by default for players. --- packages/lib/users.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/packages/lib/users.js b/packages/lib/users.js index 4f3fa0e8..00b90de9 100644 --- a/packages/lib/users.js +++ b/packages/lib/users.js @@ -618,16 +618,19 @@ definePermission({ name: "core.user.get", title: "Get user", description: "Get the details of a user in the cluster.", + grantByDefault: true, }); definePermission({ name: "core.user.list", title: "List users", description: "Get the full list of users in the cluster.", + grantByDefault: true, }); definePermission({ name: "core.user.subscribe", title: "Subscribe to user updates", description: "Subscribe to be notified on updates on the details and status of users.", + grantByDefault: true, }); definePermission({ name: "core.user.create",