PlayerPresents - Security Patch

🔒 Fixed: Item Duplication Exploit

Fixed an exploit where players could duplicate items using cheat clients or UI utils mods by saving and reloading the gift creation GUI.

• ✅ Locked all items in gift selection menus to prevent extraction
• ✅ Automatically detected and closed unauthorized GUI instances
• ✅ Prevented command abuse during active gift creation

Version 1.1.0

✨ New Features

🎨 Full MiniMessage Support

Lang files now support all MiniMessage tags:

• Colors: <red>, <blue>, <gold>, <green> and more
• Formatting: <bold>, <italic>, <underlined>, <strikethrough>, <obfuscated>
• Hex colors: <color:#FF9100>
• Gradients: <gradient:#FF9100:#EA1205>text</gradient>
• Rainbow: <rainbow>text</rainbow>
• Reset: <reset>

🔄 Backward Compatibility with Legacy Formatting

All legacy formats still work simultaneously:

• &c, &l, &n - classic color codes
• &#FF9100 - legacy hex format
• §c, §l, §6 - section (§) format
• §x§F§F§9§1§0§0 - § hex format

📋 PlaceholderAPI Integration

Placeholders are now automatically expanded when a player is provided:

• %player_name%, %player_health% - standard PAPI placeholders
• %nexo_shift_-48%, %nexo_size_36% - Nexo placeholders
• {from}, {for} - custom plugin placeholders

🎁 Gift Creation with MiniMessage + Placeholders

Created gifts now support:

• MiniMessage tags in name and lore
• Legacy color codes
• PlaceholderAPI placeholders that remain dynamic
• Custom formatting combinations like:

"<b><gradient:#FF9100:#EA1205>gradient</gradient></b> %nexo_shift_-48%§6Select Gift Appearance"

🔧 Bug Fixes & Improvements

🛠️ Gift.yml Auto-Update

• No longer warns about missing base64 for non-PLAYER_HEAD items
• No longer warns about missing model-data for PLAYER_HEAD items
• Automatically adds missing Present sections (Present15, Present16, etc.)
• Preserves user settings and comments during updates

📝 Message Formatting Pipeline

Messages are now processed in this order:

1. Expand PlaceholderAPI placeholders (%placeholder%)
2. Replace custom placeholders ({from}, {for})
3. Convert § hex to &#RRGGBB
4. Convert § codes to & equivalents
5. Convert & hex to MiniMessage <color:#RRGGBB>
6. Convert & codes to MiniMessage tags
7. Parse everything with MiniMessage
8. Convert to legacy § format for Minecraft

🎯 GUI Improvements

• All GUI titles now support MiniMessage + legacy colors + PlaceholderAPI
• Preview items show expanded placeholders
• Final gifts keep placeholders dynamic for real-time display
• Text input hints updated with MiniMessage examples

• ✅ Bugfix: Gifts opened from the offhand are now properly removed, fixing the infinite open exploit.

✅ Added a privacy-focused enhancement to tab completion for /present creater <player> automatically hiding the names of players who are currently in vanish mode, ensuring a cleaner and more secure admin experience.

✅ Added full version compatibility support from Minecraft 1.17 up to the latest release 1.21.10+, ensuring seamless operation across all modern server versions.

✅ Fixed skull texture rendering by implementing modern Paper API integration (PlayerProfile and ProfileProperty) compatible with all supported versions.

✅ Replaced legacy reflection-based texture injection with official Bukkit/Paper API methods for improved compatibility and stability across version range.

✅ Ensured custom skull textures display correctly in both GUI previews and created gift items on all supported server versions.

✅ Implemented proper URL extraction from Base64-encoded texture data for seamless texture application across Minecraft 1.17+.

✅ Improved long-term maintainability by using future-proof API methods that align with Minecraft's evolving server architecture and ensure continued support for upcoming versions.

✅ Verified performance and reliability across the entire supported version range (1.17 - 1.21.10+) for production environments.

✅ Added particle and sound effects for gift creation and opening with customizable settings.

✅ Implemented separate configuration for creation and opening effects via create-particle-count and open-particle-count.

✅ Fixed bug preventing gifts from being placed into containers (chests, barrels, shulker boxes, etc.).

✅ Gifts can now be stored in containers without restrictions.

✅ Fixed asynchronous gift creation process for more stable and optimized custom name and custom lore functionality.

✅ Prevented players from accidentally clicking existing gifts when selecting gift names and lore.

✅ Config auto-updates on plugin startup with missing keys and values.

Effects Configuration Example

# =====================================
# EFFECTS SETTINGS - SOUNDS AND PARTICLES
# =====================================
# Configure sound and particle effects for gift creation and opening
# All players will experience these unified effects for all gifts

effects:
  # Sound played when a gift is created
  # List of available sounds: https://hub.spigotmc.org/javadocs/spigot/org/bukkit/Sound.html
  # Examples: ENTITY_PLAYER_LEVELUP, BLOCK_NOTE_BLOCK_XYLOPHONE, ENTITY_FIREWORK_ROCKET, BLOCK_AMETHYST_BLOCK_CHIME
  # Set to "NONE" to disable sound
  create-sound: "ENTITY_PLAYER_LEVELUP"

  # Sound played when a gift is opened
  # Examples: ENTITY_ITEM_PICKUP, BLOCK_CHEST_OPEN, UI_TOAST_CHALLENGE_COMPLETE, ENTITY_FIREWORK_LAUNCH
  # Set to "NONE" to disable sound
  open-sound: "BLOCK_CHEST_OPEN"

  # Particle effect displayed when a gift is created
  # List of available particles: https://hub.spigotmc.org/javadocs/spigot/org/bukkit/Particle.html
  # Examples: FIREWORKS, HAPPY_VILLAGER, EXPLOSION_NORMAL, SPELL_WITCH, CLOUD, DRAGON_BREATH, TOTEM
  # Set to "NONE" to disable particles
  create-particle: "HAPPY_VILLAGER"

  # Particle effect displayed when a gift is opened
  # Examples: FIREWORK, CRIT, EXPLOSION_LARGE, SPELL_INSTANT, CLOUD, TOTEM
  # Set to "NONE" to disable particles
  open-particle: "FIREWORK"

  # Number of particles to spawn for creation effect
  # Recommended: 10-30
  create-particle-count: 25

  # Number of particles to spawn for opening effect
  # Recommended: 20-50
  open-particle-count: 25

✅ Implemented content filter system with regex-based pattern matching to prevent toxic, offensive, and inappropriate content in gift names and lore.

✅ Added filter.yml with pre-configured filter categories: profanity, racism, homophobia, sexism, religious intolerance, spam, and advertising.

✅ Content filter is fully configurable - enable/disable in config.yml with content-filter.enabled and content-filter.log-violations settings.

✅ Improved logging system: separated logs into three dedicated files in logs/ folder:

• create.log - Gift creation events with full item details
• open.log - Gift opening events with received items
• filter.log - Content filter violations with player info and flagged content

✅ Plugin no longer hard-blocks specific item types in code; only items explicitly listed in blacklist-items are blocked.

✅ Removed hard-coded blocking of armor and other materials — all blocking is now solely controlled by configuration.

✅ Added multi-language support for all filter violation messages in all 6 supported languages (English, Czech, German, Spanish, Japanese, Russian).

✅ Fixed Maven shade plugin configuration to properly handle bstats library merging without MANIFEST conflicts.

✅ Fixed missing keys in config.yml and language files - plugin now automatically fills in missing settings without overwriting user changes and comments.

✅ Added support for custom lore and custom name for gifts - players can now fully customize the appearance and description of their gifts with support for color codes.

✅ Fixed returning to GUI after entering text in chat.

✅ Multi-line lore with empty lines - custom gift descriptions now support \n for new lines and \n\n to create gaps.

✅ Improved placeholder system - placeholders ({from}, {for}) now work correctly in custom names and descriptions.

✅ Added sync warnings in config.yml.

✅ Fixed duplicate sections in gift.yml - prevented creation of multiple Cost: sections that caused YAML parsing errors.

✅ Better gift.yml validation without risky auto-fixes - plugin now only reports errors instead of attempting automatic fixes that could corrupt data.