?
Host a serverModrinth App
Sign in
ModsResource PacksData PacksShadersModpacksPluginsServers
Settings
YepHub

YepHub

a all in one plugin with lot of plugin combine into one

101downloads
1follower
101downloads
1follower

Links

Join Discord server

Tags

Creators

Details

Published 4 months ago
Updated 3 months ago
All versions

3.4.0

Release
3.4.04 months ago 22
Download

Compatibility

Minecraft: Java Edition
26.2
26.1.x
1.21.x
Platforms
Bukkit
Paper
Purpur
Spigot

Changes

YepHub v3.4.0

Changes

  • Upgraded password hashing from SHA-256 to BCrypt (auto-upgrades on login)
  • Added login rate limiting (3s cooldown between attempts, 30s lockout after max failures)
  • Added Discord /link command rate limiting (10s cooldown)
  • Added SFTP host key verification warning

Fixes (Security Audit — 65 bugs fixed)

  • Fixed unauthenticated player chat messages leaking to Discord
  • Fixed unauthenticated players able to be teleported by other plugins
  • Fixed Discord "No Permission" embeds visible to all users (now ephemeral)
  • Fixed backup error messages leaking server paths/hostnames to Discord
  • Fixed Dropbox/OneDrive loading entire backup archive into memory (OOM on large worlds)
  • Fixed Dropbox static PKCE values race condition
  • Fixed SFTP resource leaks on exception
  • Fixed backup freeze race condition
  • Fixed JSON injection in Dropbox API calls
  • Fixed Discord /backup-download dropdown accessible to non-admins
  • Fixed Discord bot awaitReady() blocking server startup indefinitely
  • Fixed Discord bot monitor message ID not volatile
  • Fixed monitor embed exceeding Discord 4096 char limit
  • Fixed Discord kick reason not length-validated
  • Fixed restart cancel confirmation sent before cancel actually runs
  • Fixed backup-download dropdown race window
  • Fixed chat sync JSON missing control character escaping
  • Fixed chat sync naive JSON parser (now uses Gson)
  • Fixed Embeds static fields not thread-safe (now volatile)
  • Fixed editable inventory GUI allowing item extraction
  • Fixed GUI player actions crashing when target goes offline
  • Fixed MenuHolder storing Player reference (now UUID)
  • Fixed MenuHolder.getInventory() returning null
  • Fixed statsManager null pointer in onDisable
  • Fixed BadgeManager config reload race condition
  • Fixed getMostActiveDay() skipping Sunday
  • Fixed async badge check running after stats save on player quit
  • Fixed AuthListener command filter bypass (/loginX allowed)
  • Fixed LagClear countdown tasks surviving cancel/reload
  • Fixed unbounded download thread pool (now capped at 3)
  • Fixed restart command accepting unlimited time (now capped at 24h)
  • Fixed TPA warmup check firing 20 times/sec (now throttled)
  • Fixed frozen players unable to chat during backup

YepHub v3.3.3

Changes

  • Added update checker (checks Modrinth for new versions on admin join)

Fixes

  • Fixed Discord "No Permission" embeds visible to all users (now ephemeral — only visible to the command user)
  • Fixed Discord /backup and /backup-download not detecting linked providers (loadSavedTokens() called before isLinked())
  • Fixed Dropbox token detection (loadSavedTokens() before isLinked() check in backup commands)
  • Fixed Discord badge roles using server name prefix (now uses only badge display name from badges.yml)