MC-114692Toolbar restore feature can be used to obtain unobtainable items
The bug
When restoring toolbars, items that are normally unobtainable through the creative inventory without the use of commands can be obtained. This can be used by players with creative mode but without operator status on servers to obtain items like dragon eggs, command blocks, structure blocks, and more.
Steps to reproduce
- In a world in which you have operator privileges, save a toolbar with dragon eggs, structure blocks, and command blocks, as well as some dirt and other items that are obtainable through the creative inventory
- Join a server on which you have creative mode (operator privileges are not required)
- Restore the toolbar, even without operator privileges
Behaviour
You will see that when you follow these reproduction steps, every item is restored, including the dragon eggs, structure blocks, and command blocks. The expected behaviour is that only the items obtainable without the use of commands would be restored.
Linked Issues
is duplicated by4
- Unresolved
![[Mod] markderickson](../../../data/avatars/users/18946.svg)
[Mod] markderickson
Ben Mintz- 32
- 25
- Confirmed
Important- Platform
- UI
- Creative
- item toolbar
17w06a - 25w05a
17w06a 17w14a 17w15a 1.12.2 1.15.1 1.15.2 1.16-rc1 1.16 1.16.1 20w28a 20w29a 20w30a 1.16.2-pre1 1.16.2-pre2 1.16.2-pre3 1.16.2-rc1 1.16.2-rc2 1.16.2 1.16.3-rc1 1.16.3 1.16.4-pre1 1.16.4-pre2 1.16.4-rc1 1.16.4 20w45a 20w46a 20w48a 20w49a 20w51a 21w03a 21w05b 21w06a 21w07a 21w08b 21w10a 21w11a 21w13a 21w14a 21w39a 22w06a 22w14a 1.19.2 1.19.3 1.19.4 23w51b 25w05a
Created Issue:
Toolbar restore feature can be used to obtain unobtainable items
![[Mod] Neko](../../../data/avatars/users/92901.png){kind=small}
![[Mojang] Grum (Erik Broes)](../../../data/assets/gravatar/grum.png){kind=small}
[Mojang] Grum (Erik Broes)relates to
MC-80483
![[Mojang] Nathan Adams](../../../data/assets/gravatar/dinnerbone.png){kind=small}
[Mojang] Grum (Erik Broes)
is duplicated by
![[Mod] Pokechu22](../../../data/avatars/users/92931.png){kind=small}
relates to
is duplicated by
relates to
is duplicated by
![[Mojang] slicedlime](../../../data/assets/gravatar/slicedlime.jpeg){kind=small}
![[Mod] Greymagic27](../../../data/avatars/users/92875.png){kind=small}
![[Mod] violine1101](../../../data/avatars/users/92858.png){kind=small}
is duplicated by
![[Bot] Arisa](../../../data/avatars/users/43007.png){kind=small}
relates to
![[Helper] Misode](../../../data/avatars/users/93314.png){kind=small}
is duplicated by
The bug
When restoring toolbars, items that are normally unobtainable through the creative inventory without the use of commands can be obtained. This can be used by players with creative mode but without operator status on servers to obtain items like dragon eggs, command blocks, structure blocks, and more.
Steps to reproduce
- In a world in which you have operator privileges, save a toolbar with dragon eggs, structure blocks, and command blocks, as well as some dirt and other items that are obtainable through the creative inventory
- Join a server on which you have creative mode (operator privileges are not required)
- Restore the toolbar, even without operator privileges
Behaviour
You will see that when you follow these reproduction steps, every item is restored, including the dragon eggs, structure blocks, and command blocks. The expected behaviour is that only the items obtainable without the use of commands would be restored.
Sign commands are intended to work similarly to command blocks instead of chat commands anyway, e.g. the slash at the beginning isn't needed, and the command is executed at the sign's location instead of the player's.
The longer command length limit on signs is a useful feature for e.g. mapmakers. Limiting the abilities of operators like that is feature removal from my point of view.
in my opinion, it's a useful feature instead of a bug
relates to
relates to
relates to
relates to
relates to
is duplicated by
relates to
Thank you for your report!
However, this issue has been resolved as a Duplicate of MC-114692.
It has been linked to this report. If you have additional information, please add it to that report.
Please search before reporting, as it's likely that one exists already.
Quick Links:
📓 Issue Guidelines – 💬 Community Support – 📧 Customer Support – 📖 Game Wiki
Thank you for your report!
We're tracking this issue in MC-114692, so this ticket is being resolved and linked as a duplicate.
If you would like to add a vote and any extra information to the main ticket it would be appreciated.
If you haven't already, you might like to make use of the search feature in the future to see if the issue has already been reported.
Quick Links:
📓 Issue Guidelines – 💬 Community Support – 📧 Customer Support – ✍️ Feedback and Suggestions – 📖 Game Wiki
I don't understand what's the difference to MC-114692 is supposed to be, can you elaborate?
Hi there!
Using command signs is different from MC-114692 because it actually allows players to access longer commands in servers that have command blocks disabled. This is because the chat command line has a limit to the characters, but command block limits are much longer, and the signs can contain commands that allow players who usually can't access these longer commands to do so.
MC-114692 only allows players to access specific items while this bug allows players to access commands that they usually wouldn't have access to.
Hi there!
This is an older version of the example commands. Please see the description for newer commands.
I have a few examples for this. The first example is more of a way that players can use to access different gamemodes in servers that aren't necessarily theirs. The second example is a give command, allowing players who don't have access to long commands to access them here. Example 2 relates more to MC-114692, but also allows for obtaining these special items even if the player is deopped at a later time.
Example 1:
- Create a command sign with the command /gamemode creative, for example. The command to create this sign (from minecraft.tools) is in the command 1 area at the bottom of this comment.
- Hide the sign away, underground for example, in a world download of something like a survival world spawn.
- Post, submit, or share the world download to a website or person creating a server. If someone downloads and incorporates the world download into their server, you and anyone else who knows about the sign can click it and access creative mode.
Example 2:
- Create a command sign to receive a custom player head or a 32k item (any command, these are just ones I have examples for). I've listed the commands to get these signs for each of these actions in the command area at the bottom of the page, Command 2 for the custom player head and Command 3 for a 32k item.
- Run one or both of these commands in a creative world using command blocks. When you receive the sign(s), save them to a slot in one of your toolbars.
- Join a server where you have operator permissions. Then, place the signs down. Even if this operator status is only temporary, you can still access and click these signs as much as you want even if you're deopped. Other people who know about the signs can also use these signs to access these features.
**EDIT: Apparently, the way that Jira formatted the commands made them not work anymore. I've replaced the broken commands with working commands.
Command 1:
/give @p minecraft:oak_sign{BlockEntityTag:{Text1:'{"text":"Creative","clickEvent":{"action":"run_command","value":"gamemode creative"},"italic":true}'},display:{Name:'{"text":"Creative Mode"}'}}
Command 2:
/give @p minecraft:oak_sign{BlockEntityTag:{Text1:'{"text":"Custom Head!","clickEvent":{"action":"run_command","value":"give @p minecraft:player_head{display:{Name:\\"{\\\\\\"text\\\\\\":\\\\\\"Exhausted Bee\\\\\\"}\\"},SkullOwner:{Id:\\"54087a9e-d70d-4fb4-9fe1-042ae7449847\\",Properties:{textures:[{Value:\\"eyJ0ZXh0dXJlcyI6eyJTS0lOIjp7InVybCI6Imh0dHA6Ly90ZXh0dXJlcy5taW5lY3JhZnQubmV0L3RleHR1cmUvNmNjOTM2Yjk0MTgwODcyNzY3MDA4ZTNjNDI3NTRjN2FjN2FjMzQ4ZDRlMjJlOTI0ODI3MzQ0ZWMyYTY2ZjJiNCJ9fX0=\\"}]}}} 1"},"italic":true}'},display:{Name:'{"text":"Custom Head!"}'}}
Command 3:
/give @p minecraft:oak_sign{BlockEntityTag:{Text1:'{"text":"Custom Sword!","clickEvent":{"action":"run_command","value":"give @s diamond_sword{Enchantments:[{id:sharpness,lvl:32767},{id:unbreaking,lvl:32767},{id:knockback,lvl:10},{id:fire_aspect,lvl:32767},{id:looting,lvl:10},{id:sweeping_edge,lvl:10},{id:mending,lvl:1},{id:bane_of_arthropods,lvl:32767}]} 1"},"italic":true}'},display:{Name:'{"text":"Custom Sword!"}'}}
If any of these commands don't work for you, simply add a comment saying so and I'll do my best to fix it.
Thanks!
Hello!
Umbra standard command blocks cannot be placed in survival mode, so why should it be possible with command block minecarts?
This becomes even more dangerous with MC-114692, because players can execute commands even if they don't have operator status using pre-filled command block minecarts. This bug will become a lot less dangerous if players cannot place command block minecarts in survival mode.
Hello!
The issue is about players being able to execute commands that are longer than chat limit on a server in which command blocks are disabled. These commands could usually require command blocks to run, but if they are disabled, players can still get around this limitation by saving a toolbar with a sign and then copying it over to a server/world. I'll change the title too, if you'd like. When I created the report, books were not included, but then Chandler modified it to include books.
I should've cleared up the part about saved toolbars. In the current state, I'm realizing that this report is probably a duplicate of MC-114692. What I meant to report was the fact that commands that are longer than chat limit length could be used in servers/worlds that did not allow command blocks. I'll change the description too.
Finally, please disregard example 1 from the comment (I'll remove it). Commands 2 and 3 are the ones that actually are specific to this report. I'll also fix up the examples for this change.
Thank you for the feedback! Let me know if the updated report is clearer (I'll start updating now). 
Duplicate of MC-114692.
Thank you for your report!
We're tracking this issue in MC-114692, so this ticket is being resolved and linked as a duplicate.
If you would like to add a vote and any extra information to the main ticket it would be appreciated.
If you haven't already, you might like to make use of the search feature to see if the issue has already been mentioned.
Quick Links:
📓 Bug Tracker Guidelines – 💬 Community Support – 📧 Mojang Support
📓 Project Summary – ✍️ Feedback and Suggestions – 📖 Game Wiki
– I am a bot. This action was performed automatically! The ticket was resolved by one of our moderators, and I left this message to give more information to you.
Dragon eggs can still be obtained with a bit more effort, command blocks cant be used if not opped, probably WAI
What about monster spawners, say on a superflat world? Or barrier blocks?
I think that even if there weren't blocks such as these, this is still a bug because in the future there may be more blocks
that can't be obtained from the menu.
What if someone removed the only dragon egg?
I definitely don't think this is WAI. Even if these examples I just listed weren't available (leaving command blocks and the like), I still think this is a bug since Minecraft should be able to tell which blocks you should and shouldn't be able to get from the creative menu.
I don't think it's WAI, either. Barriers should not be obtainable and monster spawners even more. (Cause they could lag the world or just be cheaty. Also they are not obtainable by normal creative mode.)
This is a security issue, the hotbar save and restore function as it currently is assumes that if a player is in creative it has certain level of trust in that server over normal players, which is not the case in creative servers where players being in creative mode is the standard. A malicious player could use this to create an item with malformed NBT tags, then login into a creative server, spawn that item and crash the server. Such a malformed item would otherwise be unobtainable without specific permissions (like /give), but it is now possible for any player in creative due to how the saved toolbars work.
Please see https://bugs.mojang.com/browse/MC-145752 for my input on how to solve this implementation wise.
I would like this not to be patched as a server owner it makes it easier to transport items. It should be up to the specific server to disable/enable the toolbar validation.
Hi there!
I think this should be an added line in the server.properties file, allowing server owners to control whether or not toolbars should be allowed.
Hi there!
Can confirm for 1.16.1.
Hi there!
Can confirm for 20w27a.
Reporter changed to [Mod] markderickson upon request since original reporter no longer seems to be active since over 3 years.
This is even more dangerous, because anyone can make a command block minecart spawn egg with a command already in it. That means that only an activator rail is needed to run a command that would normally require op permissions such as /kill @a
Or you could make a command sign, which would run a specific command every time you clicked on it. insane
all those things require the player to be an operator for their data to be copied when placed
@kerran @StrongSand94191
While that is true, if command blocks are turned off, a player can use saved command signs to get commands longer than possible in chat, which is most likely a bug
This is very likely to be WAI because the toolbars purpose is to save the current toolbar and have you be able to load it. This does mean non-inventory obtainable items. In single player this is definitely working as intended because you can always obtain them in single player.
Now for multiplayer it is a bit more complicated if you are OP it would work the same as in single player as you could obtain them but if you wouldn't be OP things like command blocks, commandblock minecarts, commands on signs and commands on books.
Everything else would be normal as some of them can be obtained without commands like dragon eggs. Also allowing custom enchantments, custom books, custom player heads would not impact the server harmfully and are useful features for many building servers.
Now the fact that commands on books, commands on signs, command blocks and commandblock minecarts can be brought from the toolbar on a multiplayer server with no OP permission is a bug and should be fixed.
Issue still remains and is the absolute nightmare for any creative server. People are bringing in items with NBT tags that are so big they make other players crash and get autokicked, resulting in them being kicked again every time they log in, so basically a way to ban any player you want off a server without having op permissions.
People can bring in highly enchanted tools that can even kill players who are in creative mode.
People can bring in fireworks that last up to minutes, crashing anyone with minimal pc's.
Please mojang, just add a gamerule to the game that is /gamerule loadsavedtoolbars true/false, it will make creative server owners finally able to not have to fear for the well-being of their server every day.
This is intended. I always save my command block as a hotbar to not have to use a command to get it.