Trivial item duplication exploit in InvUI caused by `BaseWindow#close` about invui HOT 6 CLOSED

Doing window.close(false) still causes the exploit. So it must be in the body of BaseWindow#close.

Interestingly enough, while testing I also found another bug. If you do window.close(false), close the GUI yourself and then leave, this exception will be thrown:

[18:54:59 WARN]: [ItemDup] Task #25 for ItemDup v1.0 generated an exception
java.lang.IllegalStateException: The Window has already been closed.
        at de.studiocode.invui.window.impl.BaseWindow.show(BaseWindow.java:249) ~[itemdup-1.0-all.jar:?]
        at org.bukkit.craftbukkit.v1_19_R1.scheduler.CraftTask.run(CraftTask.java:101) ~[paper-1.19.2.jar:git-Paper-160]
        at org.bukkit.craftbukkit.v1_19_R1.scheduler.CraftScheduler.mainThreadHeartbeat(CraftScheduler.java:483) ~[paper-1.19.2.jar:git-Paper-160]
        at net.minecraft.server.MinecraftServer.tickChildren(MinecraftServer.java:1493) ~[paper-1.19.2.jar:git-Paper-160]
        at net.minecraft.server.dedicated.DedicatedServer.tickChildren(DedicatedServer.java:446) ~[paper-1.19.2.jar:git-Paper-160]
        at net.minecraft.server.MinecraftServer.tickServer(MinecraftServer.java:1417) ~[paper-1.19.2.jar:git-Paper-160]
        at net.minecraft.server.MinecraftServer.runServer(MinecraftServer.java:1193) ~[paper-1.19.2.jar:git-Paper-160]
        at net.minecraft.server.MinecraftServer.lambda$spin$0(MinecraftServer.java:305) ~[paper-1.19.2.jar:git-Paper-160]
        at java.lang.Thread.run(Thread.java:833) ~[?:?]

This is a different issue, but this is caused by BaseWindow#handleClose being called when an inventory is closed (which happens when a player leaves) while it's not closeable (which is why it's being reopened and throws this exception).

from invui.

Should be fixed in c315c36.

Interestingly enough, while testing I also found another bug. If you do window.close(false), close the GUI yourself and then leave, this exception will be thrown

This should also be fixed now. Though, you should never call window.close(false) (it unregisters all handlers but leaves the inventory open -> players can just take the items from the inventory). It only exists for internal use and shouldn't even be accessible to you, the same goes for all the handle... methods. I just didn't have the time to clean that stuff up yet.

from invui.

I don't use window.close(false) myself, it was just something I accidentally stumbled upon while testing if maybe that could be it.
But thanks a lot for fixing it! :)

from invui.

Can the version be bumped? I'll use JitPack for now, but I really think this fix is worth a version bump.
Actually: the JitPack build fails and outputs incomplete artifacts.

from invui.

sure

from invui.

Thanks!

Just tested the latest version and can confirm that it is now fixed. Thanks a lot! :)

from invui.