.crownseeder command usable by anyone

[median hollow]

In my small server (less than 200 people), someone with no server permissions used .crownseeder and it gave them the You are not authorized to change this .fmbot setting. notification but it went ahead and updated all of the crowns anyways.

I managed to undo it with .killallseededcrowns but not before people were able to retrieve their entire crown list (so now people hypothetically know every crown they could claim that they didn't know about).

Curious if anyone else has had this issue as well.

[thorny walrus]

I tried to reproduce this and did a few double checks, but I couldn't. Are you sure some without ban members / admin didn't push the button?

It should also tell you what user executed it

[median hollow]

sorry for the late response, how are you able to see who executed it? i ctrl-f'd the server for any evidence of anyone ever using .crownseeder and see only 1 message from someone who never had any roles in the server at all

(other 3 results were just fmbot showing command lists)

fmbot doesn't show the reply anymore but the copy paste from another member shows what it said at the time

next day on the logs that guy immediately jumped from relatively inactive in the server to rank1

until i did the killallseedecrowns command the same day

[thorny walrus]

It should say at the bottom of the crownseeder output 'initiated by x'

In the screenshot it looks like someone deleted the embed from the bot from the message, so you can't see it anymore.

Unfortunately I can't see in the logs who ran it

[median hollow]

is the embed something anyone can generally delete or only an message perms/admin can do that?

[thorny walrus]

Only someone with message perms can do that

[median hollow]

(if it's the latter i'm just going to assume another admin accidentally did it and doesn't want to fess up)

sounds good

sorry for the false flag then

thanks!

[thorny walrus]

No worries