ExploitFixer commands and permissions

ExploitFixer registers one command, /exploitfixer, with the alias /ef. The base command has no permission gate, so /ef and /ef help are available to any sender that can run commands. Administrative subcommands check permission nodes at execution time, and most of those nodes are not declared in plugin.yml.

Command tree

Command	Permission checked	Behavior
/ef, /ef help	none	Help and version output
/ef config ...	exploitfixer.admin	Runtime config edits with a 30-second confirmation step
/ef reload	exploitfixer.admin	Reload config and modules
/ef stats	exploitfixer.admin	Kicked, cached and cancelled counters
/ef notifications	exploitfixer.admin or exploitfixer.notifications	Toggle personal notifications; players only
/ef logs [type] [page]	exploitfixer.logs	Browse recent or per-player logs
/ef checks [enable|disable|toggle] <module>	exploitfixer.admin	List or toggle modules at runtime
/ef test	none	Adds random VLS to violation modules for 10 seconds

Unknown subcommands fall through to help. The config tab completion exposes clear, itemanalysis, invalidselectbundle, packetlimiter, packetfunnel and packetwatchdog, but the command surface is intentionally small: there is no per-module command for every YAML key.

Permission nodes

Node	Declared in plugin.yml	Default	Purpose
exploitfixer.admin	No	Not declared	Reload, stats, config and checks
exploitfixer.logs	No	Not declared	Log browsing
exploitfixer.notifications	No	Not declared	Self-service notification toggle
exploitfixer.bypass.packetwatcher	Yes	false	Bypass PacketWatchdog enforcement
exploitfixer.commandblocker.bypass	No	Config string, shipped as exploitfixer.commandblocker.bypass	Bypass blocked-command enforcement

Only the watchdog bypass is registered with Bukkit metadata. The other nodes are still checked in code, but a permission plugin has no declaration to display; grants must be entered explicitly. Servers that rely on operator status alone will pass the checks; a non-OP staff group needs explicit grants because exploitfixer.admin is not a declared parent of the other nodes.

exploitfixer.commandblocker.bypass is unusual: it is read from modules/command-blocker.yml under bypass-permission, so changing the config changes which node is checked. It is not a declared Bukkit permission.

The /ef test problem

TestCommand performs no permission check. The base command has no permission either, so any player who can run /ef can run /ef test. The subcommand is player-only and, for 10 seconds, adds a random value between 0 and 100 VLS to a randomly selected violation module every tick. That is enough to reach the shipped 100-VLS punishment bucket and run its configured kick or console command.

/ef test
→ Starting VLS test simulation for 10 seconds...
→ Added <random> VLS to module: <module>

Treat this as a development aid, not a diagnostic. It does not prove that a specific module detects real traffic; it injects synthetic violations across whatever modules are loaded.

Because there is no node to deny, a permission plugin cannot gate this subcommand by itself. Restrict it externally:

• Block /ef test and /exploitfixer test for non-admin senders with a command-filtering plugin, and verify the block with a non-OP account.
• Or remove the test branch from ExploitFixerCommand in a private build and redeploy the JAR.
• Do not rely on hiding the command from tab completion; the dispatcher still accepts it.

Operator checklist

1. Grant exploitfixer.admin, exploitfixer.logs and exploitfixer.notifications explicitly to the staff groups that need them.
2. Keep exploitfixer.bypass.packetwatcher limited to accounts that genuinely need to bypass processing-time enforcement; it is the only node Bukkit shows in permission listings.
3. Restrict /ef test outside the plugin.
4. Remember that /ef reload only reloads config and modules. It does not install a new JAR or reload server-side packet hooks.

For installation prerequisites, see Install ExploitFixer; for thresholds and module keys, see Configure ExploitFixer. The packet-validation case study covers the design behind these commands.

Verified against ExploitFixer d065b6b (version 4.1.2, 24 October 2026) on 30 October 2026. Command behavior and permission checks come from source; no live permission-provider test was run.