Package com.ultikits.ultitools.manager

Class CommandExecutionManager

java.lang.Object

com.ultikits.ultitools.manager.CommandExecutionManager

@Internal
public class CommandExecutionManager
extends Object

Command execution manager. Handles command execution requests received over the WebSocket connection.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
private static class	CommandExecutionManager.CommandOutputCapture	Command output capture.
static class	CommandExecutionManager.CommandResult	Command result data class.

Field Summary

Fields

Modifier and Type	Field	Description
private static final String	ACTION_EXECUTE_COMMAND	The RemoteActionLog.Entry.getAction() literal for every entry this class records.
private Set<String>	blockedCommands	Blocklist of dangerous commands that should not be executed remotely.
private static final String	BLOCKLIST_CONFIG_KEY	The literal config path loadConfiguration() reads and every configurable refusal this class produces names — ultipanel.commands.blocklist.
private final com.google.gson.Gson	gson
private final ConcurrentHashMap<String,CompletableFuture<CommandExecutionManager.CommandResult>>	pendingCommands
private UltiPanelWebSocketClient	webSocketClient

Constructor Summary

Constructors

Constructor	Description
CommandExecutionManager()

Method Summary

Modifier and Type	Method	Description
void	executeCommand(com.google.gson.JsonObject commandData)	Executes a command received from the panel.
private void	executeCommandInternal(String command, String executor, String commandId, long startTime)	Internal command execution logic.
AccessDecision	isCommandAllowed(String command)	Whether a command is allowed for remote execution.
final void	loadConfiguration()	Loads ultipanel.commands.blocklist from config.yml, copying ErrorReportCollector.loadConfiguration()'s exact shape: a null-guard on UltiTools.getInstance(), one try/catch whose failure branch keeps the current blocklist and logs a warning naming the key.
private static String	resolveActor(String executor)	The action-log actor field — the inbound executor field verbatim, or the literal "panel" when absent.
private void	sendCommandResult(String commandId, boolean success, String output, long executionTime)	Sends the command execution result.
void	setBlockedCommands(Set<String> commands)	Set the blocklist of commands that should not be executed remotely.
void	setWebSocketClient(UltiPanelWebSocketClient client)	Sets the WebSocket client.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

webSocketClient

private UltiPanelWebSocketClient webSocketClient

pendingCommands

private final ConcurrentHashMap<String,CompletableFuture<CommandExecutionManager.CommandResult>> pendingCommands

gson

private final com.google.gson.Gson gson

BLOCKLIST_CONFIG_KEY

private static final String BLOCKLIST_CONFIG_KEY

The literal config path loadConfiguration() reads and every configurable refusal this class produces names — ultipanel.commands.blocklist.

See Also:

• Constant Field Values

ACTION_EXECUTE_COMMAND

private static final String ACTION_EXECUTE_COMMAND

The RemoteActionLog.Entry.getAction() literal for every entry this class records.

See Also:

• Constant Field Values

blockedCommands

private Set<String> blockedCommands

Blocklist of dangerous commands that should not be executed remotely. This is the shipped default, used only when ultipanel.commands.blocklist is absent from config.yml — see loadConfiguration().

Constructor Details

CommandExecutionManager

public CommandExecutionManager()

Method Details

loadConfiguration

public final void loadConfiguration()

Loads ultipanel.commands.blocklist from config.yml, copying ErrorReportCollector.loadConfiguration()'s exact shape: a null-guard on UltiTools.getInstance(), one try/catch whose failure branch keeps the current blocklist and logs a warning naming the key.

Distinguishes an absent key from an explicit empty list via isSet(path) — Bukkit's getStringList returns an empty list for both, and collapsing that distinction would make D-03's honest "block nothing" escape value silently impossible (T-06-12). The shipped ten-command default applies only when the key is absent; an explicit empty list is honored as the operator deliberately granting every command.

setBlockedCommands

public void setBlockedCommands(Set<String> commands)

Set the blocklist of commands that should not be executed remotely. This is now loadConfiguration()'s config-load target, not just a test-only seam — it has zero production call sites of its own, but every operator-configured blocklist reaches this class through it.

Parameters:

commands - Set of command names to block (case-insensitive)

isCommandAllowed

public AccessDecision isCommandAllowed(String command)

Whether a command is allowed for remote execution.

Extracts the base command (the first word) and strips any namespace prefix (e.g. bukkit:op -> op, minecraft:stop -> stop) BEFORE checking it against the operator-configured blocklist at ultipanel.commands.blocklist in plugins/UltiTools/config.yml — so both the bare command and its namespaced form are blocked; the stripping order is what makes that true. The blocklist is editable in both directions — an operator may remove any of the ten shipped defaults, add to them, or clear the list entirely — and there is deliberately no unoverridable floor beneath it (D-04): a floor would constrain the operator without constraining an attacker who already holds the operator's identity, since the same outcomes remain reachable through other commands or a third-party plugin's own admin commands.

Parameters:

command - The command to check (with or without leading slash)

Returns:

an AccessDecision naming why a refused command was refused

setWebSocketClient

public void setWebSocketClient(UltiPanelWebSocketClient client)

Sets the WebSocket client.

Parameters:

client - the WebSocket client

executeCommand

public void executeCommand(com.google.gson.JsonObject commandData)

Executes a command received from the panel.

executeCommandInternal

private void executeCommandInternal(String command,
 String executor,
 String commandId,
 long startTime)

Internal command execution logic.

resolveActor

private static String resolveActor(String executor)

The action-log actor field — the inbound executor field verbatim, or the literal "panel" when absent. Mirrors PluginInitiationUtils.resolveActor(JsonObject) exactly: the framework cannot attribute a remote command to an individual panel operator today (see RemoteActionLog.Entry's javadoc), so this never invents a per-operator identity.

sendCommandResult

private void sendCommandResult(String commandId,
 boolean success,
 String output,
 long executionTime)

Sends the command execution result.