Players can obtain barrier blocks through the claiming interface

[tt-thoma]

This issue had already been addressed in #59 but it seems that it isn't patched, at least not in the latest versions:

Paper 1.21.3 - build 36
XClaim 1.15.1 (SpigotMC website)

The glitch hasn't changed:

1. Place an item frame
2. Create a new claim
3. In the claim menu, you have a barrier block - click on the item frame with it
4. Quit the server
5. Rejoin and take the barrier block from the frame

8mb.video-Koz-HMFF8rPM.mp4

As a temporary fix, you can put this command in repeating command blocks (tested on 1.21.3):

/kill @e[type=minecraft:item_frame, nbt={Item: {id:"minecraft:barrier"}}]
/kill @e[type=minecraft:glow_item_frame, nbt={Item: {id:"minecraft:barrier"}}]

8mb.video-M5V-6NA6vRvb.mp4

[RHX0R3]

I can confirm, that this problem is a general one!
My server is currently on 1.21.1 (Paper) and I was able to recreate that instantly.
Please fix ASAP!

[WasabiThumb]

This is fixed in the imminent v2 release but seeing as this is a critical issue I don't mind patching it quickly

[tt-thoma]

Do note that disabling automatic closing of the claim menu when leaving does not make people attempting the glitch stuck because you can still exit by clicking an empty hotbar slot

[WasabiThumb]

Also seems Paper-specific as Spigot does not physically have PlayerItemFrameChangeEvent, and its inclusion likely diverts the code path away from PlayerInteractEvent which is already caught & neutralized

[WasabiThumb]

Here's the dev build (from this branch), won't be able to test myself for at least a few hours.
xclaim-1.15.1.jar

[RHX0R3]

Works! Can't interact with an item frame anymore, when in editing mode - nice!
Thank you for the fast fix.

[RHX0R3]

Will 1.21.4 also work? Can't upgrade yet, since Paper is currently not fully released for 1.21.4.

[WasabiThumb]

Will 1.21.4 also work? Can't upgrade yet, since Paper is currently not fully released for 1.21.4.

I don't see why not, since XClaim doesn't use any bleeding API or server internals. It broke for ~1.20 due to using server internals via ParticleLib, but ParticleLib is now completely removed from the plugin. It's fetched automatically for older servers. That being said, you never really know until you try. The most likely issue is maybe Adventure sneaking out of date, which should be helped by Dependabot and completely obsoleted soon-ish.

[RHX0R3]

Still works with Allays! :o

[RHX0R3]

Also with Armor Stands :/

[WasabiThumb]

😐 The scope of exceptions to the interaction system never ceases to amaze me. Feel free to create another issue.