OPShield

[1.4.0] — 2026-04-14

Security hardening

• migrated password storage to op_password_hash so plaintext is no longer kept in config after migration
• added PBKDF2 password hashing for new stored credentials
• preserved backward compatibility for older SHA-256 hashes during migration
• made firewall execution explicitly unsafe and opt-in only via allow_unsafe_firewall_exec
• disabled auto-punishment by default to reduce accidental false positives on fresh installs

Logic fixes

• fixed IP-limit detection so it counts unique accounts inside a real rolling time window
• changed OP whitelist enforcement to apply to /op only
• added lockout count decay after a configurable cooling-off period
• cleaned expired lockouts and expired IP flags automatically on a schedule
• localized shadow-ban fake success messages instead of hardcoding English strings in Java

Performance and maintainability

• replaced repeated async save spawns with a debounced persistent save loop
• replaced synchronous audit file writes with queued async flushes
• added basic audit log rotation
• cached CommandMap reflection result instead of resolving it on every blocked command
• split hashing and audit logging into dedicated helper classes

Permissions and command handling

• added opshield.op
• added opshield.deop
• added opshield.admin
• added opshield.bypass
• kept /opshield reload and /opshield unlock <player|ip> as admin management commands

Config changes

• added op_password_hash
• retained op_password only as a legacy migration input
• added broadcast_on_privilege_change
• added audit.*
• added security.lockout.track_ip
• added security.lockout.count_decay_hours
• added auto_punishment.window_seconds
• added auto_punishment.custom_command
• added auto_punishment.allow_unsafe_firewall_exec
• added ip_limit.auto_punish
• added ip_limit.flag_duration_minutes