Fixes an exploit which allowed the player to set a new home while a warmup was in progress

src/main/java/org/morganm/homespawnplus/HomeSpawnPlus.java

@@ -111,7 +111,13 @@ public class HomeSpawnPlus extends JavaPlugin {
     public final static String YAML_CONFIG_ROOT_PATH = "plugins/HomeSpawnPlus/";
     public final static String YAML_BACKUP_FILE = YAML_CONFIG_ROOT_PATH + "backup.yml";
 	public final static String BASE_PERMISSION_NODE = "hsp";
-
+
+	// This flag is used to prevent the execution of /sethome while the player
+	// is currently in a warmup. Without it, it is possible to create a new
+	// set point while mid-warmup which then allows the player to arbitrarily
+	// bounce between two /home points where only one may be allowed
+	public static boolean isInWarmup = false;
+
 	// These registrations are required for Bukkit's YAML serialization to work
 	static {
 		ConfigurationSerialization.registerClass(SerializableHome.class, "Home");

src/main/java/org/morganm/homespawnplus/commands/Home.java

@@ -76,6 +76,9 @@ public boolean execute(final Player p, final org.bukkit.command.Command command,
 		String cooldownName = null;
 		org.morganm.homespawnplus.entity.Home theHome = null;
 
+	   if( hasWarmup(p, warmupName) )
+	      HomeSpawnPlus.isInWarmup = true;
+
 		StrategyResult result = null;
 		Location l = null;
 		if( args.length > 0 ) {
@@ -85,19 +88,22 @@ public boolean execute(final Player p, final org.bukkit.command.Command command,
 			if( args[0].startsWith("w:") ) {
 				if( !plugin.hasPermission(p, OTHER_WORLD_PERMISSION) ) {
 					util.sendLocalizedMessage(p, HSPMessages.CMD_HOME_NO_OTHERWORLD_PERMISSION);
+					HomeSpawnPlus.isInWarmup = false;
 	    			return true;
 				}
 
 				String worldName = args[0].substring(2);
 				theHome = util.getDefaultHome(p.getName(), worldName);
 				if( theHome == null ) {
 					util.sendLocalizedMessage(p, HSPMessages.CMD_HOME_NO_HOME_ON_WORLD, "world", worldName);
+					HomeSpawnPlus.isInWarmup = false;
 					return true;
 				}
 			}
 			else {
 				if( !plugin.hasPermission(p, NAMED_HOME_PERMISSION) ) {
 					util.sendLocalizedMessage(p, HSPMessages.CMD_HOME_NO_NAMED_HOME_PERMISSION);
+					HomeSpawnPlus.isInWarmup = false;
 					return true;
 				}
 
@@ -120,6 +126,7 @@ public boolean execute(final Player p, final org.bukkit.command.Command command,
 
 			if( l == null ) {
 				util.sendLocalizedMessage(p, HSPMessages.CMD_HOME_NO_NAMED_HOME_FOUND, "name", homeName);
+				HomeSpawnPlus.isInWarmup = false;
 				return true;
 			}
 		}
@@ -130,8 +137,10 @@ public boolean execute(final Player p, final org.bukkit.command.Command command,
 		}
 
 		debug.debug("home command running cooldown check, cooldownName=",cooldownName);
-		if( !cooldownCheck(p, cooldownName) )
-			return true;
+		if( !cooldownCheck(p, cooldownName) ) {
+		   HomeSpawnPlus.isInWarmup = false;
+		   return true;
+		}
 
 		final StrategyContext context;
 		if( result != null )
@@ -147,6 +156,7 @@ public boolean execute(final Player p, final org.bukkit.command.Command command,
     		if( playerDirectedArg && !p.getWorld().getName().equals(l.getWorld().getName()) &&
     				!plugin.hasPermission(p, OTHER_WORLD_PERMISSION) ) {
 				util.sendLocalizedMessage(p, HSPMessages.CMD_HOME_NO_OTHERWORLD_PERMISSION);
+				HomeSpawnPlus.isInWarmup = false;
     			return true;
     		}
 
@@ -166,10 +176,13 @@ public void run() {
 							doHomeTeleport(p, finalL, cdName, context,
 									finalHome, finalIsNamedHome);
 						}
+
+						HomeSpawnPlus.isInWarmup = false;
 					}
 
 					public void cancel() {
-						canceled = true;
+					   HomeSpawnPlus.isInWarmup = false;
+					   canceled = true;
 					}
 
 					public void setPlayerName(String playerName) {}

src/main/java/org/morganm/homespawnplus/commands/SetHome.java

@@ -38,6 +38,7 @@
 import org.bukkit.entity.Player;
 import org.morganm.homespawnplus.HomeSpawnPlus;
 import org.morganm.homespawnplus.command.BaseCommand;
+import org.morganm.homespawnplus.i18n.Colors;
 import org.morganm.homespawnplus.i18n.HSPMessages;
 import org.morganm.homespawnplus.storage.Storage;
 
@@ -64,6 +65,13 @@ public boolean execute(final Player p, final Command command, final String[] arg
 		if( !isEnabled() || !hasPermission(p) )
 			return true;
 
+		if( HomeSpawnPlus.isInWarmup ) {
+		   Colors.setDefaultColor("%rose%");
+		   util.sendLocalizedMessage(p, HSPMessages.WARMUP_IN_PROGRESS);
+		   Colors.setDefaultColor("%yellow%");
+		   return true;
+		}
+
 		String cooldownName = null;
 		String homeName = null;
 

src/main/java/org/morganm/homespawnplus/i18n/HSPMessages.java

@@ -112,6 +112,7 @@ public enum HSPMessages {
 	WARMUP_ALREADY_PENDING,
 	WARMUP_CANCELLED_DAMAGE,
 	WARMUP_CANCELLED_YOU_MOVED,
+	WARMUP_IN_PROGRESS,
 
 	COOLDOWN_IN_EFFECT,
 

src/main/resources/lang/hsp_de.properties

@@ -18,6 +18,7 @@ WARMUP_CANCELLED_DAMAGE=Du hast Schaden genommen! Warmup %name% abgebrochen.
 WARMUP_CANCELLED_YOU_MOVED=Du hast dich bewegt! Warmup %name% abgebrochen.
 WARMUP_STARTED=Warmup %name% gestartet, du musst noch %time% warten.
 WARMUP_ALREADY_PENDING=Dein Warmup für %name% läuft bereits.
+WARMUP_IN_PROGRESS=Kann nicht erteilen Befehl beim Aufwärmen.
 
 COST_CHARGED=%price% eingezahlt um %command% zu nutzen.
 COST_ERROR=Fehler beim Abziehen von %price% deines Kontos: %errorMessage%

src/main/resources/lang/hsp_en.properties

@@ -69,6 +69,7 @@ WARMUP_CANCELLED_DAMAGE=You took damage! Warmup "%name%" cancelled.
 WARMUP_CANCELLED_YOU_MOVED=You moved! Warmup "%name%" cancelled.
 WARMUP_STARTED=Warmup "%name%" started, you must wait %seconds% seconds.
 WARMUP_ALREADY_PENDING=Warmup already pending for "%name%".
+WARMUP_IN_PROGRESS=Cannot issue this command while warming up.
 
 COST_CHARGED=%price% charged for use of the %command% command.
 COST_ERROR=Error subtracting %price% from your account: %errorMessage%

src/main/resources/lang/hsp_es.properties

@@ -69,6 +69,7 @@ WARMUP_CANCELLED_DAMAGE=Te has echo daño! Teletransporte "%name%" cancelado.
 WARMUP_CANCELLED_YOU_MOVED=Te has movido! Teletransporte "%name%" cancelado.
 WARMUP_STARTED=Teletransporte "%name%" iniciado, debes esperar %seconds% segundos.
 WARMUP_ALREADY_PENDING=Teletransporte pendiente a "%name%".
+WARMUP_IN_PROGRESS=No se puede emitir comandos durante el calentamiento.
 
 COST_CHARGED=Gastado %price% por el uso del comando: "%command%".
 COST_ERROR=Error al cobrar %price% de tu cuenta: %errorMessage%.

src/main/resources/lang/hsp_fr.properties

@@ -73,6 +73,7 @@ WARMUP_CANCELLED_DAMAGE=Vous subissez des dommages ! Compte à rebours pour "%na
 WARMUP_CANCELLED_YOU_MOVED=Vous bougez ! Compte à rebours pour "%name%" annulé. Veuillez exécuter la commande de nouveau.
 WARMUP_STARTED=Veuillez patienter %seconds% secondes avant l'exécution de la commande "%name%".
 WARMUP_ALREADY_PENDING=Le compte à rebours est déjà lancé pour "%name%".
+WARMUP_IN_PROGRESS=Vous ne pouvez pas lancer la commande pendant l'échauffement.
 
 COST_CHARGED=L'utilisation de la commande %command% vous coûte %price%.
 COST_ERROR=Erreur : Impossible de débiter votre compte de %price% : %errorMessage%

src/main/resources/lang/hsp_nl.properties

@@ -79,6 +79,7 @@ WARMUP_CANCELLED_DAMAGE=%default_color%Je hebt schade opgelopen! Laden van "%nam
 WARMUP_CANCELLED_YOU_MOVED=%default_color%Je bent verplaatst! Laden van "%name%" geannuleerd.
 WARMUP_STARTED=%default_color%Laden van "%name%" begonnen, je moet %seconds% seconden wachten.
 WARMUP_ALREADY_PENDING=%default_color%Al aan het wachten op het laden van "%name%".
+WARMUP_IN_PROGRESS=Kan niet meer afgeven commando tijdens het opwarmen.
 
 COOLDOWN_IN_EFFECT=%default_color%Cooldown "%name%" is bezig. Je moet nog %seconds% seconden wachten.
 

src/main/resources/lang/hsp_pt-br.properties

@@ -72,6 +72,7 @@ WARMUP_CANCELLED_DAMAGE=Alguem bateu em voce! Intervalo "%name%" cancelado.
 WARMUP_CANCELLED_YOU_MOVED=Voce se moveu! Intervalo "%name%" cancelado.
 WARMUP_STARTED=Intervalo "%name%" iniciado, voce precisa aguardar %seconds% segundos.
 WARMUP_ALREADY_PENDING=Intervalo esta sendo processado para "%name%".
+WARMUP_IN_PROGRESS=N�o pode emiss�o comando enquanto cobertor el�trico acima.
 
 COST_CHARGED=%price% retirado pelo uso do comando %command%.
 COST_ERROR=Erro ao tirar %price% da sua conta: %errorMessage%

src/main/resources/lang/hsp_pt.properties

@@ -73,6 +73,7 @@ WARMUP_CANCELLED_DAMAGE=Voce tomou dano! Warmup "%name%" cancelado.
 WARMUP_CANCELLED_YOU_MOVED=Voce se moveu! Warmup "%name%" cancelado.
 WARMUP_STARTED=Warmup "%name%" iniciado, voce deve aguardar %seconds% segundos.
 WARMUP_ALREADY_PENDING=Warmup ja pendente para "%name%".
+WARMUP_IN_PROGRESS=N�o pode edi��o comando enquanto cobertor el�ctrico acima.
 
 COST_CHARGED=%price% carregada para a utilizacao do comando %command%.
 COST_ERROR=Error tirando %price% da sua conta: %errorMessage%

src/main/resources/lang/hsp_ru.properties

@@ -68,6 +68,7 @@ WARMUP_CANCELLED_DAMAGE=Вы получили повреждения! Разог
 WARMUP_CANCELLED_YOU_MOVED=Вы двинулись! Разогрев "%name%" отменен.
 WARMUP_STARTED=Разогрев "%name%" начался, вы должны подождать %seconds% секунд.
 WARMUP_ALREADY_PENDING=Разогрев уже рассматривается "%name%".
+WARMUP_IN_PROGRESS=Не можете выдать команду во время разминки.
 
 COOLDOWN_IN_EFFECT=Кулдаун "%name%" начал действовать. вы должны подождать %seconds% секунд.