Players can use selectors in vanilla commands.

[Anna Bakker]

Players can use @p, @a, @r in any vanilla command they have access to. for example /me @a will use /me and then list all the players ingame after it. /msg SlowRiot @a[r=350] Will message SlowRiot saying all the players within 350 blocks of the person using the command. @p is nearest player @a is all players and @r is random player. Other things can be done such as listing all players with a certain amount of min xp level, listing all player above a certain height and much more things. This also could be used by players trying to find the nearest player without waiting for the cooldown on /nearestplayer by using /msg or /me @p. These selectors can only be used in vanilla commands, for example /goodnight @a will not list all players after a goodnight message and instead will just say Player says goodnight @a. Selectors can also be used in /tp, so you could use /tp @r to teleport to a random player.

[Riot]

One workaround could potentially be to reinplement all remaining vanilla commands with exec. However, to actually resolve this issue would be to to canary as this is obviously unrelated to scripts.

Can you make a comprehensive list of affected commands? Saying "aby vanilla command" is somewhat imprecise.

[Anna Bakker]

Affected commands:

• /me, /emote (alias of /me). Example: /me @a will show 22:19 <@McObot> (MCS) * Anna_28 Anna_28, 44trent3, Bjs300, JuanR0310, twinchicken86 and Draco297 where the first Anna_28 is from the /me and the rest of the names are all the online players from the @a.
• /tp. Examples: /tp @p @r which will teleport the nearest player (player using command) to a random player.
• /message, /msg, /tell. Though the selector will only work for the <player> part of the message. For example /msg @p[rm=5] test @p[rm=5] will show You whisper to twinchicken86 test @p[rm=5] where twinchicken is the nearest player outside of a 5 block radius around the player using the command.

[Riot]

So just two commands available to ordinary players?

[Riot]

rewriting vanilla /me and /msg commands as exec variants, re #183 and resolves #150 (should be effective as of next server restart)

→ <<cset cb79595ae213>>

[Evan Markowitz]

For starts this isn't really a script issue, however, all player-facing commands which could be abused using this functionality have since been replaced