v1.7.0

• Download:
  • GitHub
  • Modrinth

Security

• Fixed channel chat permission issues (GHSA-7gmf-j543-53pr)
  • /lc channel info showed the owner and members of private channels to any player, and its tab completion listed them. Private channels are now shown only to their members and to players with lunaticchat.channelbypass.
  • /lc channel invite added the player at once and switched their active channel, so any player could pull another player into their own channel and receive that player's next message. It now sends an invitation, which the player accepts with /lc channel join <channelId> within 5 minutes. Their active channel does not change until they accept.
  • Channel moderators could kick or ban the owner and other moderators. /lc channel kick and ban now only work on players with a lower channel role than yours. See Roles and Permissions.
• Added protection against forged cross-server messages (GHSA-4p78-89rh-8px5)
  • Behind an outdated Velocity plugin, a player with a modified client could post cross-server chat and direct messages under any name, make them look like server announcements, stall the server, or add fake lines to the server log.
  • Global chat and direct messages from other servers are now shown only after the connection with Velocity is established. Nothing from other servers appears while /lcv status shows HANDSHAKING or FAILED.
  • Formatting codes (§) and line breaks in names and messages from other servers are now removed instead of applied. A features.velocityIntegration.serverName written with color codes is shown without them on other servers.
  • Such messages can no longer stall the server or add fake lines to the server log.

Improvements

• A player joining no longer makes the server re-check the spy permission of every online player, which cost more the more players were online.
  • A spy whose permission is revoked while online stops receiving spy copies right away.
  • A player who is given the spy permission while online starts receiving spy copies after they re-join.
• /lc channel kick, ban, unban, mod and ownership no longer risk stalling the server while looking up a player name.
  • The target is looked up only among players the server already knows. A player who changed their name and has not joined since must be named by their old name.
• Performed internal cleanup.

Notes

• If you use Velocity integration, update the Velocity plugin to v1.4.0 as well. The fix for GHSA-4p78-89rh-8px5 is in the Velocity plugin; updating only the Paper plugin does not close it.
• Channel invitations that have not been accepted are lost when the server restarts.