Change default permissions for "/trigger", "/version", and "/plugins".

[Mickey42302]

I would like to suggest changing the default permissions for a few commands: "/trigger", "/plugins", and "/version".

Typing "/plugins" allows people to see a list of plugins that are installed on the server. Most server owners don't want regular players to have this information. So, the "/plugins" command should be restricted to operators by default.

Typing "/version" allows people to see what version of Paper is installed. Most server owners don't want regular players to have this information either. So, the "/version" command should also be restricted to operators by default.

As for "/trigger", most players don't even need this command. Thus, based on the principle of least privilege, it would be more secure to restrict the command to operators by default. The "/trigger" command should only be available to regular players if the server owner grants the permission via a permissions plugin (such as LuckPerms).

[electronicboy]

Changing default permissions of vanilla commands is just not something we want to deal with, all it does is blindly break peoples stuff

as for the rest, we don't consider this to be priviliged information, if people don't want to expose that information they can hide it using permissions

[Machine-Maker]

Hard no on the /trigger change. Tons of datapacks use this as a command players can run by default, changing the default would break a ton of stuff.

And I second what cat said about the other 2 commands.

[mbax]

Most server owners don't want regular players to have this information.

Big assumption there. Anecdotally I know tons of servers who are proud to list the plugins they use. As I always tell folks, if copying your plugin list lets someone clone and steal players from your server, it wasn't unique to begin with.

As for the other typical argument I see around plugin version info, security concerns, attackers don't generally check your server/plugin version(s) before trying a plugin exploit - they just try it and move on if it doesn't work due to being patched.

[Mickey42302]

I reverted the change for "/trigger".

So far, every server I've played on has denied access to "/version" and "/plugins". They only allow staff members to have the information.