# WorldProtection A comprehensive world protection plugin for Paper/Spigot servers that allows administrators to protect specific worlds with a whitelist system. Even operators are blocked from accessing protected worlds unless explicitly whitelisted. ## Features ### Core Features - **World Protection Toggle**: Enable or disable protection on any world - **Whitelist System**: Only whitelisted players can access protected worlds - **Operator Blocking**: Blocks operators from accessing protected worlds (unless whitelisted) - **Case-Insensitive World Lookup**: World names are matched case-insensitively for convenience - **Player Teleport Command**: `/wp go ` allows players to teleport to worlds (blocks if not whitelisted) - **Multiple Access Methods Blocked**: Prevents access via: - World changes - Teleportation commands - Portal usage (nether portals, end portals, etc.) - Direct world joining - **Data Persistence**: Protected worlds and whitelists are saved automatically - **Config Reload**: Reload configuration without restarting server - **Multiverse Support**: Compatible with Multiverse-Core (soft dependency) ### Security Features - Operators are blocked by default (configurable) - Operators are always teleported away (kicks may not work on ops) - Bypass permission available but still respects operator blocking - Automatic teleportation to safe world when access is denied - Configurable safe world for teleportation - Optional kick on access denial (default: enabled) - Customizable kick message ## Requirements - Paper 1.21.x or compatible - Java 21 - Multiverse-Core (optional, for Multiverse world management) ## Installation 1. Download the latest JAR from the releases page 2. Place `WorldProtection-1.0.0.jar` in your server's `plugins/` folder 3. Start or restart your server 4. Configure `plugins/WorldProtection/config.yml` to your preferences 5. Use `/wp toggle ` to protect worlds 6. Use `/wp whitelist add ` to whitelist players ## Configuration ### config.yml ```yaml # World Protection Configuration # Default message when access is denied messages: prefix: "&c[WorldProtection]&f " access_denied: "&cYou do not have permission to access this world!" world_protected: "&eWorld &6%world% &eis protected. Only whitelisted players can access it." world_unprotected: "&aWorld &6%world% &ais now unprotected." world_protected_enabled: "&aWorld &6%world% &ais now protected." player_whitelisted: "&aPlayer &e%player% &ahas been whitelisted for world &6%world%&a." player_unwhitelisted: "&cPlayer &e%player% &ahas been removed from whitelist for world &6%world%&c." not_whitelisted: "&cYou are not whitelisted for world &6%world%&c." world_not_found: "&cWorld &6%world% &cnot found!" no_worlds_protected: "&7No worlds are currently protected." teleport_success: "&aTeleported to world &6%world%&a." teleport_denied: "&cYou do not have permission to teleport to world &6%world%&c." # Block operators from accessing protected worlds (unless whitelisted) block_operators: true # Kick players who try to access protected worlds kick_on_deny: true # Safe world to teleport players to when access is denied (if kick_on_deny is false) # Leave empty to auto-find a safe world safe_world: "" # Kick message when player is not whitelisted kick_message: "&4You are not whitelisted on this world" ``` ### Configuration Options **messages** - All messages can be customized with color codes - Use `%world%` placeholder for world names - Use `%player%` placeholder for player names **block_operators** - `true`: Operators are blocked from protected worlds (unless whitelisted) - `false`: Operators can access protected worlds (not recommended) **kick_on_deny** - `true`: Players are kicked when they try to access a protected world (default) - `false`: Players are teleported back to a safe world - Note: Operators are always teleported (kicks may not work on ops) **safe_world** - Name of the world to teleport players to when access is denied and `kick_on_deny` is `false` - Leave empty (`""`) to automatically find a safe world - Must be a valid world name **kick_message** - Custom message shown when a player is kicked for accessing a protected world - Supports color codes (use `&` prefix) - Default: `"&4You are not whitelisted on this world"` ## Commands ### Player Commands **/worldprotection go ** or **/wp go ** - Teleport to a world (available to all players) - Blocks teleportation if the world is protected and you're not whitelisted - Example: `/wp go creative` - Note: World names are case-insensitive ### Admin Commands All admin commands require `worldprotection.admin` permission (default: OP). **/worldprotection toggle ** or **/wp toggle ** - Enable or disable protection on a world - Example: `/wp toggle creative` - Note: World names are case-insensitive **/worldprotection whitelist add ** or **/wp whitelist add ** - Add a player to the whitelist for a protected world - Example: `/wp whitelist creative add PlayerName` - Note: World names are case-insensitive **/worldprotection whitelist remove ** or **/wp whitelist remove ** - Remove a player from the whitelist for a protected world - Example: `/wp whitelist creative remove PlayerName` - Note: World names are case-insensitive **/worldprotection list** or **/wp list** - List all currently protected worlds - Shows the number of whitelisted players per world **/worldprotection info ** or **/wp info ** - Show detailed information about a world's protection status - Displays protection status and whitelisted players - Note: World names are case-insensitive **/worldprotection reload** or **/wp reload** - Reload the configuration file and data - Requires admin permission - Example: `/wp reload` ## Permissions **worldprotection.admin** - Full admin access to all world protection commands - Default: `op` (operators only) - Allows: toggle protection, manage whitelist, view info **worldprotection.bypass** - Bypass world protection (not recommended) - Default: `op` (operators only) - Note: Still blocked if `block_operators: true` in config ## Usage Examples ### Protecting a World 1. Protect a world: ``` /wp toggle creative ``` Output: `[WorldProtection] World creative is now protected.` 2. Whitelist players: ``` /wp whitelist creative add PlayerName /wp whitelist creative add AnotherPlayer ``` 3. Check protection status: ``` /wp info creative ``` ### Unprotecting a World 1. Remove protection: ``` /wp toggle creative ``` Output: `[WorldProtection] World creative is now unprotected.` 2. Note: Whitelist is preserved but not enforced when world is unprotected ### Managing Whitelist **Add a player:** ``` /wp whitelist creative add PlayerName ``` **Remove a player:** ``` /wp whitelist creative remove PlayerName ``` **View all protected worlds:** ``` /wp list ``` ## How It Works ### Protection Mechanism When a player attempts to access a protected world, the plugin: 1. **Checks if world is protected** - If not protected, access is allowed 2. **Checks if player is whitelisted** - If whitelisted, access is allowed 3. **Checks bypass permission** - If player has `worldprotection.bypass`, access is allowed - Exception: If `block_operators: true` and player is OP, still blocked 4. **Blocks access if all checks fail** - If `kick_on_deny: true`: Kicks player with configured kick message - If `kick_on_deny: false`: Teleports player to safe world (configured or auto-found) - Operators are always teleported away (kicks may not work on ops) - Sends access denied message - Multiple event handlers ensure blocking works regardless of access method ### Access Methods Blocked The plugin blocks access through: - **World Changes**: When a player changes worlds (via any method) - **Player Join**: When a player joins the server in a protected world - **Teleportation**: All teleportation commands and events (including `/wp go`) - **Portals**: Nether portals, end portals, and other portal types ### Operator Blocking Operators are handled specially: - They are always blocked from protected worlds (when `block_operators: true`) - They are always teleported away (kicks may not work on operators) - Multiple event handlers ensure operators cannot stay in protected worlds - Even if a kick fails, operators are immediately teleported to a safe world ### Data Storage Protected worlds and whitelists are stored in: ``` plugins/WorldProtection/data.yml ``` This file is automatically created and updated when: - Worlds are protected/unprotected - Players are added/removed from whitelists ## File Structure ``` plugins/WorldProtection/ ├── config.yml # Configuration file └── data.yml # Protected worlds and whitelists (auto-generated) ``` ## Troubleshooting **Operators can still access protected worlds:** - Check `block_operators` in config.yml (should be `true`) - Ensure operators are not whitelisted - Verify they don't have `worldprotection.bypass` permission - Operators should be teleported away immediately - if not, check server logs - Try using `/wp go ` as an operator - you should be blocked and teleported away **Players can still access protected worlds:** - Check if world is actually protected: `/wp list` - Verify player is not whitelisted: `/wp info ` - Check if player has bypass permission **Whitelist not working:** - Ensure world is protected: `/wp toggle ` - Verify player was added correctly: `/wp info ` - Check data.yml file for correct UUIDs **Players getting stuck:** - If a player is in a protected world when protection is enabled, they will be teleported out immediately - Use `/wp whitelist add ` to allow them access - Or temporarily unprotect the world: `/wp toggle ` - Players can use `/wp go ` to attempt teleportation (will be blocked if not whitelisted) **Multiverse worlds not working:** - Ensure Multiverse-Core is installed (optional but recommended) - World names are matched case-insensitively, so you can use any case - Use `/mv list` to see world names, but you can use any case variation ## Security Considerations ### Operator Blocking By default, operators are blocked from accessing protected worlds. This is intentional and provides additional security: - Prevents accidental access by admins - Ensures only explicitly whitelisted players can access - Maintains strict access control - Operators are always teleported away (kicks may not work on operators) - Multiple event handlers ensure operators cannot bypass protection To allow operators access, you must: 1. Whitelist them: `/wp whitelist add ` 2. Or set `block_operators: false` in config.yml (not recommended) **Important**: Even if `kick_on_deny` is enabled, operators are teleported instead of kicked, as server protections may prevent kicking operators. ### Bypass Permission The `worldprotection.bypass` permission exists for special cases but: - Still respects `block_operators` setting - Should be used sparingly - Consider whitelisting instead for better tracking ## API ### Public Methods ```java // Check if a world is protected boolean isWorldProtected(String worldName) // Check if a player is whitelisted for a world boolean isPlayerWhitelisted(UUID playerUUID, String worldName) // Check if a player can access a world boolean canAccessWorld(Player player, String worldName) ``` ### Events The plugin listens to and handles: - `PlayerJoinEvent` - Blocks players joining in protected worlds - `PlayerChangedWorldEvent` - Blocks world changes - `PlayerTeleportEvent` - Blocks teleportation - `PlayerPortalEvent` - Blocks portal usage ## Version Current Version: 1.0.0 ## Support For issues, feature requests, or questions, please open an issue on the project repository. ## License This plugin is provided as-is for use on Minecraft servers. ## Credits Developed for Paper 1.21.x servers with optional Multiverse-Core integration.

Creative Inventory II

Anvil

Crafting Table

Creative Inventory I

Achievements

Villager

Furnace

Enchanting Table