From a47b8033857973588a0da98d3ebdc5d970176fa9 Mon Sep 17 00:00:00 2001
From: md_5 <git@md-5.net>
Date: Fri, 21 Dec 2018 09:50:54 +1100
Subject: [PATCH] #2568: Check permissions for inject_commands

---
 .../main/java/net/md_5/bungee/api/plugin/Command.java | 11 +++++++++++
 .../net/md_5/bungee/api/plugin/PluginManager.java     |  7 +++----
 .../net/md_5/bungee/connection/DownstreamBridge.java  |  8 +++++---
 3 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/api/src/main/java/net/md_5/bungee/api/plugin/Command.java b/api/src/main/java/net/md_5/bungee/api/plugin/Command.java
index 54fa39c9..eba3040a 100644
--- a/api/src/main/java/net/md_5/bungee/api/plugin/Command.java
+++ b/api/src/main/java/net/md_5/bungee/api/plugin/Command.java
@@ -51,4 +51,15 @@ public abstract class Command
      * @param args arguments used to invoke this command
      */
     public abstract void execute(CommandSender sender, String[] args);
+
+    /**
+     * Check if this command can be executed by the given sender.
+     *
+     * @param sender the sender to check
+     * @return whether the sender can execute this
+     */
+    public boolean hasPermission(CommandSender sender)
+    {
+        return permission == null || permission.isEmpty() || sender.hasPermission( permission );
+    }
 }
diff --git a/api/src/main/java/net/md_5/bungee/api/plugin/PluginManager.java b/api/src/main/java/net/md_5/bungee/api/plugin/PluginManager.java
index 479dfb5c..3a871787 100644
--- a/api/src/main/java/net/md_5/bungee/api/plugin/PluginManager.java
+++ b/api/src/main/java/net/md_5/bungee/api/plugin/PluginManager.java
@@ -144,8 +144,7 @@ public class PluginManager
             return false;
         }
 
-        String permission = command.getPermission();
-        if ( permission != null && !permission.isEmpty() && !sender.hasPermission( permission ) )
+        if ( !command.hasPermission( sender ) )
         {
             if ( tabResults == null )
             {
@@ -435,8 +434,8 @@ public class PluginManager
      *
      * @return commands
      */
-    public Collection<String> getCommands()
+    public Collection<Map.Entry<String, Command>> getCommands()
     {
-        return Collections.unmodifiableCollection( commandMap.keySet() );
+        return Collections.unmodifiableCollection( commandMap.entrySet() );
     }
 }
diff --git a/proxy/src/main/java/net/md_5/bungee/connection/DownstreamBridge.java b/proxy/src/main/java/net/md_5/bungee/connection/DownstreamBridge.java
index 2248a685..25b81722 100644
--- a/proxy/src/main/java/net/md_5/bungee/connection/DownstreamBridge.java
+++ b/proxy/src/main/java/net/md_5/bungee/connection/DownstreamBridge.java
@@ -12,6 +12,7 @@ import java.io.DataInput;
 import io.netty.buffer.ByteBuf;
 import io.netty.buffer.ByteBufAllocator;
 import io.netty.buffer.Unpooled;
+import java.util.Map;
 import lombok.RequiredArgsConstructor;
 import net.md_5.bungee.BungeeCord;
 import net.md_5.bungee.ServerConnection;
@@ -26,6 +27,7 @@ import net.md_5.bungee.api.connection.ProxiedPlayer;
 import net.md_5.bungee.api.event.PluginMessageEvent;
 import net.md_5.bungee.api.event.ServerConnectEvent;
 import net.md_5.bungee.api.event.ServerKickEvent;
+import net.md_5.bungee.api.plugin.Command;
 import net.md_5.bungee.api.score.Objective;
 import net.md_5.bungee.api.score.Position;
 import net.md_5.bungee.api.score.Score;
@@ -540,11 +542,11 @@ public class DownstreamBridge extends PacketHandler
 
         if ( BungeeCord.getInstance().config.isInjectCommands() )
         {
-            for ( String command : bungee.getPluginManager().getCommands() )
+            for ( Map.Entry<String, Command> command : bungee.getPluginManager().getCommands() )
             {
-                if ( commands.getRoot().getChild( command ) == null )
+                if ( commands.getRoot().getChild( command.getKey() ) == null && command.getValue().hasPermission( con ) )
                 {
-                    LiteralCommandNode dummy = LiteralArgumentBuilder.literal( command )
+                    LiteralCommandNode dummy = LiteralArgumentBuilder.literal( command.getKey() )
                             .then( RequiredArgumentBuilder.argument( "args", StringArgumentType.greedyString() )
                                     .suggests( Commands.SuggestionRegistry.ASK_SERVER ) )
                             .build();