Potential security issue

[ghost]

RPGHorses/RPGHorsesPlugin/src/main/java/org/plugins/rpghorses/listeners/InventoryClickListener.java

Line 402 in 45d5674

} else if (horseOwner.getCurrentHorse() != null && e.getView().getTitle().equals(horseOwner.getCurrentHorse().getHorse().getName()) && e.getView().getTopInventory() == e.getClickedInventory() && e.getSlot() == 0) {

Checking event.getView().getTitle() to see whether your custom inventory is being used is unsafe, as renaming a chest in an anvil allows users to set their own inventory titles. The correct way to check if your custom inventory is involved with an event is by using custom holders, see here: https://docs.papermc.io/paper/dev/custom-inventory-holder

[7rory768]

I wouldn't really call this a security issue, more like a rare bug. This just prevents the user from modifying the saddle in slot 0 of the horses inventory, I could just change it to check inventory type though sure. All it does is cancel the click.