Floodgate bugs and exploits

[TDMidkwhatisxd]

What happened?

I joined with bedrock using an auto-registered premium username, and the username was removed from /premium list.

What did you expect?

The /premium username to keep its Premium features and auto login when using Java.

Steps to reproduce

Use same bedrock username as the premium java username.

P.S. I had the nametag from floodgate to "" i mean empty, after i changed to "_" it didnt work.

Plugin list

No response

Configuration file

No response

Server log

No response

Plugin version

1.11-SNAPSHOT-ef6f0fc

Platform

Spigot

Relevance

• I tried the latest build
• I checked for existing tickets -
  If there are, please vote them with a thumps reaction and not create new ones

[TDMidkwhatisxd]

The problem is, I have to go in console and do /premium command for the player. And worse because his account is changed to offline, his items are gone :(
edit: Bedrock players should get kicked if the premium account already exist on the server, to avoid this problem.

[TuxCoding]

And worse because his account is changed to offline, his items are gone :(

This is normal, because it uses the premium UUID feature.

Please post your configuration file.

EDIT: And the server log at the time of the login.

[TDMidkwhatisxd]

There is nothing in the logs :/
Config: https://paste.gg/p/anonymous/23af18efefe04801b19735bff1ea24e2

I wanna fastlogin to allow floodgate to bypass name check, but if the name is already register and in premium mode, i wanna the bedrock user to be kicked, or just dont turn the account offline :(

[Smart123s]

In my experiences (from about 2 months ago), Floodgate and unlinked Java players with the same name and different UUIDs. As a result, they had different inventories, but everyone (both Java & Bedrock) got to keep their items. The problems is that most Auth plugins use usernames instead of UUIDs to store their data.

If you'd like to further read about UUIDs in FastLogin & Floodgate, I have written about my tests here: #494 (comment). Some of the surrounding comments are also related, but they are not too important.

EDIT: also, by not using prefixes, your server will actually store data about two separate players (separate UUIDs) with the same name, which might cause problems with other plugins as well.

[TDMidkwhatisxd]

You don't understand what I mean.

1. Plugin glitched and didnt apply the prefixes, even tho floodgate show that the prefix is working in logs.
2. What i mean, is that fastlogin turn already registered premium users to offline. Note: existing registered users
3. I wanna the bedrock users to skip name check, but not skip name check for registered premium users.

[TDMidkwhatisxd]

I think its an easy fix, if you just check if the account is registered by fastlogin and is in premium mode. Its like an extra check.

[Smart123s]

1. Plugin glitched and didnt apply the prefixes, even tho floodgate show that the prefix is working in logs.

Are you using ProtocolLib? If so, #493

2. What i mean, is that fastlogin turn already registered premium users to offline. Note: existing registered users

I'm kinda lost here. I don't know about any kind of code (related to Floodgate) that'd do that. Could you please post your server logs & configs. It'd help me out a lot.

3. I wanna the bedrock users to skip name check, but not skip name check for registered premium users.

So let's take an example, to make sure that I understand you correctly. Let's say we have the following players registered on our server.

Name	Registration (on your server)	What should happen, if a player with that name connects through Geyser
A	Premium Java Player	Kick the player
B	Cracked Java Player (but someone else has bought Minecraft with that username)	Let the player join
C	Cracked Java Player (but no one else has bought Minecraft with that username)	Let the player join

[TDMidkwhatisxd]

allowFloodgateNameConflict: true

This option allow name conflict on already registered premium players.

edit: i don't allow cracked players to use premium names, only for floodgate.

[Smart123s]

I think its an easy fix, if you just check if the account is registered by fastlogin and is in premium mode. Its like an extra check.

So if this happens, the player (who is using Floodgate) should be kicked, right?

[TDMidkwhatisxd]

Yes, because the premium name is already registered.

[Smart123s]

I think its an easy fix, if you just check if the account is registered by fastlogin and is in premium mode. Its like an extra check.

It's actually not, because (as of now) Floodgate saves both Premium Java and Floodgate players as premium = true in it's database (FastLogin.db*). So there's no way to check if a player was registered by Floodgate or by Java. And saving who registered a player into the database would take more than just a few lines of code.

If you are curious, you can open FastLogin.db with DB Browser for SQLite.

[TDMidkwhatisxd]

I think its an easy fix, if you just check if the account is registered by fastlogin and is in premium mode. Its like an extra check.

It's actually not, because (as of now) Floodgate saves both Premium Java and Floodgate players as premium = true in it's database (FastLogin.db*). So there's no way to check if a player was registered by Floodgate or by Java. And saving who registered a player into the database would take more than just a few lines of code.

If you are curious, you can open FastLogin.db with DB Browser for SQLite.

Nope, it saves as premium = false
edit: because i didnt set to autologin.
edit2: this is why i say, just check if its registered and premium = true