YepHub

YepHub v3.4.1

Changes

• Added kit system with badge-based kit claiming, creation, editing, and deletion
• Added /kit command with create, edit, delete, set badge, set cooldown, list, and reload subcommands
• Added kit GUI menus with enchantment glow effects and click sounds
• Upgraded kit GUIs: kit icons now render the kit's first real item, the claim menu shows a 10-cell rank progress bar with next-rank time, and the preview/edit/badge/cooldown/delete menus show a kit-info header
• Added home system (/sethome, /home, /delhome) with GUI menu and TPA-style teleport warmup
• Added homes config (max-homes, warmup-seconds) in config.yml
• Added homes-messages.yml and kits-messages.yml for customizable messages
• Changed all chat prefixes from [YEP] to [YepHub]
• Moved all databases to database/ folder (accounts.db, kits.db)

Fixes

• Fixed auth auto-login persisting across server restarts (sessions now reset on restart)
• Fixed kit GUI crashing when a kit has an invalid/empty badge value in the database
• Fixed kits.enabled config not being respected by the /kit command
• Fixed creating a kit with an existing name showing success while failing to save
• Fixed /kit reload not actually reloading kit data (now reconnects the database)
• Fixed kit claim giving items before the claim is recorded (could double-give on failure)
• Fixed kit serialization dropping legitimate black stained glass panes
• Fixed kit editable menus allowing border panes to be picked up or dragged
• Fixed kit admin permission inconsistency (reload now uses yephub.kits.admin)
• Fixed kit messages not using the configurable kits-messages.yml values
• Fixed NoClassDefFoundError when Floodgate is not installed (Bedrock detection now uses reflection)
• Fixed auth never prompting /login or /register when Floodgate is absent (caused by the crash above)
• Fixed kit claim failing with a PRIMARY KEY constraint error when re-claiming a cooldown kit (claim time is now refreshed)
• Fixed kit cooldowns never applying (SQLite UTC timestamps were read in local time, breaking the elapsed-time check)
• Added remaining cooldown time display in the kit claim/preview GUIs and sound feedback when a kit is on cooldown
• Fixed kit preview GUI showing broken (kit items overlapped the border panes; items now render cleanly in the middle rows)
• Fixed the kit info chest in create/edit menus being saved as a kit item (slot 4 is now reserved and excluded from saves)
• Fixed passwords appearing in the server console ("issued server command: /login <password>") — a Log4J filter now hides login/register/changepassword command lines
• Fixed Discord link spam when Discord is disabled (join message, GUI items, and /link /unlink now respect discord.enabled)
• Fixed GUI buttons running "yep _{" which only redirected to /yhelp (now use standalone commands: /link, /playtime, /stats, /deaths, /unlink, /yrestart, /yreload, /ybackup)}
• Added a Kit Manager in the Admin Panel (menu → Admin Panel → Kit Manager) covering everything /kit does: create (with chat name prompt), edit, badge, cooldown, delete, reload, and view kits
• Redesigned the Admin Panel and Kit Manager GUIs: dark/red (admin) and dark/orange (kits) border theme, glowing header icons, richer status lore, and click sounds on every button
• Redesigned the kit list selection menus with the same orange theme (header shows kit count and click action)
• Fixed the badge tablist/nametag going stale after a badge upgrade (init branch dead-loop skipped the refresh; tab/nametag now update on both silent-init and real upgrade)
• Fixed badge nametag prefixes disappearing for players with the sidebar enabled (the per-player scoreboard replaced every second now re-applies the main scoreboard's badge teams)

Fixes (2nd bugfix pass — concurrency, data loss, OAuth, threading)

• Fixed SQLite concurrency races (shared dbLock now serializes all Stats/Auth/Kit database access; BCrypt hashing/verification runs async with main-thread callbacks)
• Fixed backup "replace" mode deleting the freshly uploaded archive (old backups are now deleted by name, never the new one)
• Fixed offline player stats being wiped by syncAllBadgesOnStartup (getAll() now reads full rows instead of partial in-memory metadata)
• Fixed Dropbox listing only the first 2000 entries (has_more/cursor pagination) and leaking HTTP connections (disconnect() on all Dropbox/OneDrive requests)
• Fixed FTP download progress sending -1.0 which crashed the progress embed (String.repeat negative) — now clamped 0.0–1.0
• Fixed Discord /link cooldown reply crashing with IllegalStateException (cooldown check moved before deferReply)
• Fixed Discord slash commands re-registering every startup (count mismatch 23 vs 24 registered commands)
• Fixed OAuth state lost between provider instances (static PendingAuthState bridge for Dropbox/Google/OneDrive flows)
• Fixed main-thread blocking in Discord/backup/GUI paths (cheap hasSavedTokenFile() checks, async token loads, player messages via runTask)
• Fixed RestartManager: cancellable shutdown task, volatile countdown, and no false "cancelled" broadcast
• Fixed LagClearManager ignoring config toggles and leaking countdown tasks
• Fixed SleepListener (rewritten): per-world sleep tracking, quit cleanup, progress/skip only when a sleeper remains
• Fixed KitManager (rewritten): dbLock, try-with-resources, UTC claim-time parsing, PK-conflict recovery, robust logging
• Fixed AchievementManager duplicate milestone announcements and DiscordRoleManager recursion on role creation
• Fixed kit claim/list GUIs cutting off kits past 34 slots (now paginated) and Online Players menu past 45 players
• Fixed kit edit menu painting items under borders (items start at slot 9) and editable GUI allowing drag/number-key/outside-window item theft
• Fixed kit preview/editable-menu saves clobbering live player inventories (open-time snapshot diff, only changed slots written)
• Fixed TPA warmup cancellation messages hardcoded/"because you moved" on damage/quit (now configurable with {reason}), and bypass permission no longer blocked by target's TPA-disabled opt-out
• Fixed sidebar showing negative time-to-next-rank when a rank override is set (now computed from natural rank, clamped ≥ 0)
• Fixed chat sync blocking the Discord thread on SQLite lookups and UpdateChecker leaking connections

YepHub v3.4.0

Changes

• Upgraded password hashing from SHA-256 to BCrypt (auto-upgrades on login)
• Added login rate limiting (3s cooldown between attempts, 30s lockout after max failures)
• Added Discord /link command rate limiting (10s cooldown)
• Added SFTP host key verification warning

Fixes (Security Audit — 65 bugs fixed)

• Fixed unauthenticated player chat messages leaking to Discord
• Fixed unauthenticated players able to be teleported by other plugins
• Fixed Discord "No Permission" embeds visible to all users (now ephemeral)
• Fixed backup error messages leaking server paths/hostnames to Discord
• Fixed Dropbox/OneDrive loading entire backup archive into memory (OOM on large worlds)
• Fixed Dropbox static PKCE values race condition
• Fixed SFTP resource leaks on exception
• Fixed backup freeze race condition
• Fixed JSON injection in Dropbox API calls
• Fixed Discord /backup-download dropdown accessible to non-admins
• Fixed Discord bot awaitReady() blocking server startup indefinitely
• Fixed Discord bot monitor message ID not volatile
• Fixed monitor embed exceeding Discord 4096 char limit
• Fixed Discord kick reason not length-validated
• Fixed restart cancel confirmation sent before cancel actually runs
• Fixed chat sync JSON missing control character escaping
• Fixed chat sync naive JSON parser (now uses Gson)
• Fixed Embeds static fields not thread-safe (now volatile)
• Fixed editable inventory GUI allowing item extraction
• Fixed GUI player actions crashing when target goes offline
• Fixed MenuHolder storing Player reference (now UUID)
• Fixed MenuHolder.getInventory() returning null
• Fixed statsManager null pointer in onDisable
• Fixed BadgeManager config reload race condition
• Fixed getMostActiveDay() skipping Sunday
• Fixed async badge check running after stats save on player quit
• Fixed AuthListener command filter bypass (/loginX allowed)
• Fixed LagClear countdown tasks surviving cancel/reload
• Fixed unbounded download thread pool (now capped at 3)
• Fixed restart command accepting unlimited time (now capped at 24h)
• Fixed TPA warmup check firing 20 times/sec (now throttled)
• Fixed frozen players unable to chat during backup