I recently started up a sponge/forge survival/economy server after migrating from Bukkit and somehow a couple players manged to change their gamemode to creative and I’m very confused as to how this was possible.
I confirmed that they did not gain access to either OP or admin permissions and the server config is set up to automatically default all player’s gamemode to survival upon login even for OPs and admins. I also double checked my default permissions and there’s nothing that would allow them to do this.
Is there some sort of gamemode exploit that currently exists in sponge/forge, or hacks available to do this because afaik none exist so this shouldn’t of been possible. The only thing I can figure is they were able to exploit one of my plugins…? Any insight would be appreciated. Thanks.
Unfortunately no… I wasn’t thinking and reloaded the server after I banned them and lost the logs, but while it was going on I was taking a look through console and in my logs, but didn’t see anything that stood out to me.
They all had default permissions which doesn’t enable them to change their gamemode and it’s impossible for them to get OP since you need access to console. They also tried to break my block protections, but couldn’t. They were only able to do damage outside of spawn.
At first they were just flying which I assumed was just a fly hack until they started laying down tnt that they didn’t obtain legitimately. When I switched them back to survival mode and they fell out of the air, so it wasn’t a fly hack they were using it was creative mode.
It happened again. It seems everyone is logging in originally with creative although default gamemode is set to survival. They’re all spawning themselves blocks of diamond… lol.
Latest log file attached (I saved the logs this time).
All I can figure is that… the map I’m using for my sever was created in creative mode and sponge seems to be defaulting players to that rather than what’s in the server.properties file?? which is set to force survival mode.
The odd thing is force gamemode is working for me and I’m OP. This problem seems to be only effecting the original login, but I’d have to confirm. I have the fml-server log available (see download link it was too large for pastebin).