v1.0.4 更新日志

修复与优化

• 地毯假人安全防护拦截（正版真人登录历史识别）：
  • 彻底解决了玩家可以通过地毯模组的 /player <name> spawn 命令生成与已注册账号或正版玩家同名的假人，进而免密继承并盗取他人背包和物资的安全漏洞。
  • 引入了全新的 PremiumPlayerManager 组件，在正版玩家真人首次登录服务器时，安全、自动地将该玩家的登录历史持久化至 config/auth/premium_players.json。
  • 现在当使用 /player 生成假人时，系统将执行两阶段智能检查：
    • 已注册校验：检查假人名字是否在 accounts.json 中已注册。若是，强制拒绝生成。
    • 正版真人登录历史校验：检查假人名字是否是正版玩家，且是否在 premium_players.json 中存在真人登录历史。若是，强制拒绝生成；若其虽然是正版，但从未有真人登录过（仅做测试或为全新玩家名字），则不予拦截，确保灵活便捷。
  • 所有假人的登录判定与拦截记录，均使用 TuanzisServerMod.debug(String) 规范地输出至调试日志中，方便随时回溯与分析安全事件。

v1.0.4 Changelog

Bug Fixes & Optimizations

• Carpet Fake Player Security Defense (Premium Real Player Login Tracking):
  • Completely resolved the security exploit where players could use Carpet Mod's /player <name> spawn command to spawn fake players with the same name as registered accounts or premium players, bypassing authentication and looting their inventories or items.
  • Introduced the new PremiumPlayerManager component to automatically and securely persist premium players' real login history into config/auth/premium_players.json upon their first connection.
  • Spawning fake players via /player now triggers a two-phase smart check:
    • Registered Account Check: Verifies if the fake player name is registered in accounts.json. If yes, the spawn attempt is strictly rejected.
    • Premium Login History Check: Verifies if the name belongs to a premium account and has real login records in premium_players.json. If yes, the spawn attempt is strictly rejected. If the premium account has never logged in as a real player (e.g. testing or a new player name), the spawn is allowed.
  • All fake player checks and safety block incidents are logged using the standardized TuanzisServerMod.debug(String) method for convenient auditing and trace analyses.