Merge branch 'stable' into next-minor

.github/workflows/main.yml

@@ -198,7 +198,7 @@ jobs:
         uses: shivammathur/setup-php@2.21.1
         with:
           php-version: 8.0
-          tools: php-cs-fixer:3.2
+          tools: php-cs-fixer:3.8
 
       - name: Run PHP-CS-Fixer
         run: php-cs-fixer fix --dry-run --diff --ansi

.php-cs-fixer.php

@@ -70,6 +70,10 @@ BODY,
 			'scope' => 'namespaced',
 			'include' => ['@all'],
 		],
+		'new_with_braces' => [
+			'named_class' => true,
+			'anonymous_class' => false,
+		],
 		'no_closing_tag' => true,
 		'no_empty_phpdoc' => true,
 		'no_extra_blank_lines' => true,

SECURITY.md

@@ -7,10 +7,11 @@ GitHub is public and anyone can see the issues you post on the issue tracker, in
 
 **WARNING: You may put live servers at risk by reporting a vulnerability on the GitHub issue tracker.**
 
-**Contact us** by sending an email to [**team@pmmp.io**](mailto:team@pmmp.io?subject=Security%20Vulnerability%20in%20PocketMine-MP). Include the following information:
+**Contact us** by sending an email to [**security@pmmp.io**](mailto:security@pmmp.io). Include the following information:
 
 - Version of PocketMine-MP
 - Detailed description of the vulnerability (e.g. how to exploit it, what the effects are)
+- Your GitHub username, if you wish to be credited for reporting the problem in the security advisory
 
 Please note that we can't guarantee a reply to every email.
 

changelogs/4.7.md

@@ -21,3 +21,11 @@ Released 14th August 2022.
 - Fixed Turtle Master potions not giving any effects.
 - Unimplemented items are no longer craftable.
 - Fixed incorrect items appearing in item frames (due to an obsolete workaround for 1.19.10).
+
+# 4.7.2
+Released 16th August 2022.
+
+## Fixes
+- Fixed crash when processing player skins with invalid geometry data.
+- Fixed spectator players being able to pick blocks using mousewheel click.
+- Improved supporting requirements for sugarcane.

src/VersionInfo.php

@@ -31,7 +31,7 @@ use function str_repeat;
 
 final class VersionInfo{
 	public const NAME = "PocketMine-MP";
-	public const BASE_VERSION = "4.7.2";
+	public const BASE_VERSION = "4.7.3";
 	public const IS_DEVELOPMENT_BUILD = true;
 	public const BUILD_CHANNEL = "beta";
 

src/block/Sugarcane.php

@@ -99,7 +99,7 @@ class Sugarcane extends Flowable{
 
 	public function onNearbyBlockChange() : void{
 		$down = $this->getSide(Facing::DOWN);
-		if($down->isTransparent() && !$down->isSameType($this)){
+		if(!$this->isValidSupport($down)){
 			$this->position->getWorld()->useBreakOn($this->position);
 		}
 	}
@@ -123,9 +123,10 @@ class Sugarcane extends Flowable{
 		$down = $this->getSide(Facing::DOWN);
 		if($down->isSameType($this)){
 			return parent::place($tx, $item, $blockReplace, $blockClicked, $face, $clickVector, $player);
-		}elseif($down->getId() === BlockLegacyIds::GRASS || $down->getId() === BlockLegacyIds::DIRT || $down->getId() === BlockLegacyIds::SAND || $down->getId() === BlockLegacyIds::PODZOL){
+		}elseif($this->isValidSupport($down)){
 			foreach(Facing::HORIZONTAL as $side){
-				if($down->getSide($side) instanceof Water){
+				$sideBlock = $down->getSide($side);
+				if($sideBlock instanceof Water || $sideBlock instanceof FrostedIce){
 					return parent::place($tx, $item, $blockReplace, $blockClicked, $face, $clickVector, $player);
 				}
 			}
@@ -133,4 +134,15 @@ class Sugarcane extends Flowable{
 
 		return false;
 	}
+
+	private function isValidSupport(Block $block) : bool{
+		$id = $block->getId();
+		//TODO: rooted dirt, moss block
+		return $block->isSameType($this)
+			|| $id === BlockLegacyIds::GRASS
+			|| $id === BlockLegacyIds::DIRT
+			|| $id === BlockLegacyIds::PODZOL
+			|| $id === BlockLegacyIds::MYCELIUM
+			|| $id === BlockLegacyIds::SAND;
+	}
 }

src/entity/Skin.php

@@ -28,7 +28,6 @@ use pocketmine\utils\Limits;
 use function implode;
 use function in_array;
 use function json_encode;
-use function json_last_error_msg;
 use function strlen;
 use const JSON_THROW_ON_ERROR;
 
@@ -68,9 +67,10 @@ final class Skin{
 		}
 
 		if($geometryData !== ""){
-			$decodedGeometry = (new CommentedJsonDecoder())->decode($geometryData);
+			try{
-			if($decodedGeometry === false){
+				$decodedGeometry = (new CommentedJsonDecoder())->decode($geometryData);
-				throw new InvalidSkinException("Invalid geometry data (" . json_last_error_msg() . ")");
+			}catch(\RuntimeException $e){
+				throw new InvalidSkinException("Invalid geometry data: " . $e->getMessage(), 0, $e);
 			}
 
 			/*

src/entity/effect/StringToEffectParser.php

@@ -35,7 +35,7 @@ final class StringToEffectParser extends StringToTParser{
 	use SingletonTrait;
 
 	private static function make() : self{
-		$result = new self;
+		$result = new self();
 
 		$result->register("absorption", fn() => VanillaEffects::ABSORPTION());
 		$result->register("blindness", fn() => VanillaEffects::BLINDNESS());

src/event/HandlerListManager.php

@@ -31,7 +31,7 @@ class HandlerListManager{
 	private static ?self $globalInstance = null;
 
 	public static function global() : self{
-		return self::$globalInstance ?? (self::$globalInstance = new self);
+		return self::$globalInstance ?? (self::$globalInstance = new self());
 	}
 
 	/** @var HandlerList[] classname => HandlerList */

src/item/StringToItemParser.php

@@ -41,7 +41,7 @@ final class StringToItemParser extends StringToTParser{
 	use SingletonTrait;
 
 	private static function make() : self{
-		$result = new self;
+		$result = new self();
 
 		foreach(DyeColor::getAll() as $color){
 			$prefix = fn(string $name) => $color->name() . "_" . $name;

src/item/enchantment/StringToEnchantmentParser.php

@@ -35,7 +35,7 @@ final class StringToEnchantmentParser extends StringToTParser{
 	use SingletonTrait;
 
 	private static function make() : self{
-		$result = new self;
+		$result = new self();
 
 		$result->register("blast_protection", fn() => VanillaEnchantments::BLAST_PROTECTION());
 		$result->register("efficiency", fn() => VanillaEnchantments::EFFICIENCY());

src/network/mcpe/handler/LoginPacketHandler.php

@@ -165,13 +165,13 @@ class LoginPacketHandler extends PacketHandler{
 				if(!is_array($claims["extraData"])){
 					throw new PacketHandlingException("'extraData' key should be an array");
 				}
-				$mapper = new \JsonMapper;
+				$mapper = new \JsonMapper();
 				$mapper->bEnforceMapType = false; //TODO: we don't really need this as an array, but right now we don't have enough models
 				$mapper->bExceptionOnMissingData = true;
 				$mapper->bExceptionOnUndefinedProperty = true;
 				try{
 					/** @var AuthenticationData $extraData */
-					$extraData = $mapper->map($claims["extraData"], new AuthenticationData);
+					$extraData = $mapper->map($claims["extraData"], new AuthenticationData());
 				}catch(\JsonMapper_Exception $e){
 					throw PacketHandlingException::wrap($e);
 				}
@@ -193,12 +193,12 @@ class LoginPacketHandler extends PacketHandler{
 			throw PacketHandlingException::wrap($e);
 		}
 
-		$mapper = new \JsonMapper;
+		$mapper = new \JsonMapper();
 		$mapper->bEnforceMapType = false; //TODO: we don't really need this as an array, but right now we don't have enough models
 		$mapper->bExceptionOnMissingData = true;
 		$mapper->bExceptionOnUndefinedProperty = true;
 		try{
-			$clientData = $mapper->map($clientDataClaims, new ClientData);
+			$clientData = $mapper->map($clientDataClaims, new ClientData());
 		}catch(\JsonMapper_Exception $e){
 			throw PacketHandlingException::wrap($e);
 		}

src/network/mcpe/raklib/RakLibInterface.php

@@ -84,8 +84,8 @@ class RakLibInterface implements ServerEventListener, AdvancedNetworkInterface{
 
 		$this->sleeper = new SleeperNotifier();
 
-		$mainToThreadBuffer = new \Threaded;
+		$mainToThreadBuffer = new \Threaded();
-		$threadToMainBuffer = new \Threaded;
+		$threadToMainBuffer = new \Threaded();
 
 		$this->rakLib = new RakLibServer(
 			$this->server->getLogger(),

src/permission/PermissionManager.php

@@ -31,7 +31,7 @@ class PermissionManager{
 
 	public static function getInstance() : PermissionManager{
 		if(self::$instance === null){
-			self::$instance = new self;
+			self::$instance = new self();
 		}
 
 		return self::$instance;

src/player/Player.php

@@ -1558,7 +1558,7 @@ class Player extends Human implements CommandSender, ChunkListener, IPlayer{
 
 		$ev = new PlayerBlockPickEvent($this, $block, $item);
 		$existingSlot = $this->inventory->first($item);
-		if($existingSlot === -1 && $this->hasFiniteResources()){
+		if($existingSlot === -1 && ($this->hasFiniteResources() || $this->isSpectator())){
 			$ev->cancel();
 		}
 		$ev->call();

src/scheduler/AsyncPool.php

@@ -163,7 +163,7 @@ class AsyncPool{
 			throw new \InvalidArgumentException("Cannot submit the same AsyncTask instance more than once");
 		}
 
-		$task->progressUpdates = new \Threaded;
+		$task->progressUpdates = new \Threaded();
 		$task->setSubmitted();
 
 		$this->getWorker($worker)->stack($task);

src/utils/SingletonTrait.php

@@ -28,7 +28,7 @@ trait SingletonTrait{
 	private static $instance = null;
 
 	private static function make() : self{
-		return new self;
+		return new self();
 	}
 
 	public static function getInstance() : self{

src/world/WorldCreationOptions.php

@@ -48,7 +48,7 @@ final class WorldCreationOptions{
 	}
 
 	public static function create() : self{
-		return new self;
+		return new self();
 	}
 
 	/** @phpstan-return class-string<Generator> */