spotless

Signed-off-by: Glease <[email protected]>

.github/scripts/test-no-error-reports.sh

@@ -1,33 +0,0 @@
-#!/usr/bin/env bash
-
-RUNDIR="run"
-CRASH="crash-reports"
-SERVERLOG="server.log"
-
-if [[ -d $RUNDIR/$CRASH ]]; then
-  echo "Crash reports detected:"
-  cat $RUNDIR/$CRASH/crash*.txt
-  exit 1
-fi
-
-if grep --quiet "Fatal errors were detected" $SERVERLOG; then
-  echo "Fatal errors detected:"
-  cat server.log
-  exit 1
-fi
-
-if grep --quiet "The state engine was in incorrect state ERRORED and forced into state SERVER_STOPPED" $SERVERLOG; then
-  echo "Server force stopped:"
-  cat server.log
-  exit 1
-fi
-
-if ! grep --quiet -Po '.+Done \(.+\)\! For help, type "help" or "\?"' $SERVERLOG; then
-  echo "Server didn't finish startup:"
-  cat server.log
-  exit 1
-fi
-
-echo "No crash reports detected"
-exit 0
-

build.gradle

@@ -1,4 +1,4 @@
-//version: 1684218858
+//version: 1685785062
 /*
  DO NOT CHANGE THIS FILE!
  Also, you may replace this file at any time if there is an update available.
@@ -1276,12 +1276,14 @@ tasks.register('faq') {
     description = 'Prints frequently asked questions about building a project'
 
     doLast {
-        print("If your build fails to fetch dependencies, they might have been deleted and replaced by newer " +
-            "versions.\nCheck if the versions you try to fetch are still on the distributing sites.\n" +
-            "The links can be found in repositories.gradle and build.gradle:repositories, " +
-            "not build.gradle:buildscript.repositories - this one is for gradle plugin metadata.\n\n" +
+        print("If your build fails to fetch dependencies, run './gradlew updateDependencies'. " +
+            "Or you can manually check if the versions are still on the distributing sites - " +
+            "the links can be found in repositories.gradle and build.gradle:repositories, " +
+            "but not build.gradle:buildscript.repositories - those ones are for gradle plugin metadata.\n\n" +
             "If your build fails to recognize the syntax of new Java versions, enable Jabel in your " +
-            "gradle.properties. See how it's done in GTNH ExampleMod/gradle.properties.")
+            "gradle.properties. See how it's done in GTNH ExampleMod/gradle.properties. " +
+            "However, keep in mind that Jabel enables only syntax features, but not APIs that were introduced in " +
+            "Java 9 or later.")
     }
 }
 

src/main/java/crazypants/enderio/Log.java

@@ -2,10 +2,13 @@ package crazypants.enderio;
 
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
+import org.apache.logging.log4j.Marker;
+import org.apache.logging.log4j.MarkerManager;
 
 public final class Log {
 
     public static final Logger LOGGER = LogManager.getLogger(EnderIO.MODID);
+    public static final Marker securityMarker = MarkerManager.getMarker("SuspiciousPackets");
 
     public static void warn(String msg) {
         LOGGER.warn(msg);

src/main/java/crazypants/enderio/api/teleport/IItemOfTravel.java

@@ -4,10 +4,20 @@ import net.minecraft.entity.player.EntityPlayer;
 import net.minecraft.item.ItemStack;
 
 import cofh.api.energy.IEnergyContainerItem;
+import crazypants.enderio.config.Config;
 
 public interface IItemOfTravel extends IEnergyContainerItem {
 
     boolean isActive(EntityPlayer ep, ItemStack equipped);
 
     void extractInternal(ItemStack equipped, int power);
+
+    /**
+     * @param equipped player who is currently holding this item. caller will ensure the item held has your Item as item
+     *                 type
+     * @return -1 if method not supported, or max(can extract, power), e.g. 0 if item is empty.
+     */
+    default int canExtractInternal(ItemStack equipped, int power) {
+        return Config.strictTPItemChecking ? 0 : -1;
+    }
 }

src/main/java/crazypants/enderio/conduit/gui/ExternalConnectionContainer.java

@@ -10,6 +10,7 @@ import net.minecraft.entity.player.InventoryPlayer;
 import net.minecraft.inventory.IInventory;
 import net.minecraft.inventory.Slot;
 import net.minecraft.item.ItemStack;
+import net.minecraft.tileentity.TileEntity;
 import net.minecraft.world.World;
 import net.minecraftforge.common.util.ForgeDirection;
 
@@ -24,12 +25,14 @@ import crazypants.enderio.conduit.gui.item.InventoryUpgrades;
 import crazypants.enderio.conduit.item.IItemConduit;
 import crazypants.enderio.conduit.item.SpeedUpgrade;
 import crazypants.enderio.conduit.item.filter.IItemFilter;
+import crazypants.enderio.machine.gui.IContainerWithTileEntity;
 import crazypants.enderio.network.PacketHandler;
 
-public class ExternalConnectionContainer extends ContainerEnder<InventoryUpgrades> {
+public class ExternalConnectionContainer extends ContainerEnder<InventoryUpgrades> implements IContainerWithTileEntity {
 
     private final IItemConduit itemConduit;
     private final ForgeDirection direction;
+    private final TileEntity te;
 
     private int speedUpgradeSlotLimit = 15;
 
@@ -52,6 +55,7 @@ public class ExternalConnectionContainer extends ContainerEnder<InventoryUpgrade
         super(playerInv, new InventoryUpgrades(bundle.getConduit(IItemConduit.class), dir));
         this.direction = dir;
         this.itemConduit = bundle.getConduit(IItemConduit.class);
+        this.te = (TileEntity) bundle;
         slotLocations.addAll(playerSlotLocations.values());
 
         int x;
@@ -280,6 +284,11 @@ public class ExternalConnectionContainer extends ContainerEnder<InventoryUpgrade
         return copystack;
     }
 
+    @Override
+    public TileEntity getTileEntity() {
+        return te;
+    }
+
     private class FilterSlot extends Slot {
 
         public FilterSlot(IInventory par1iInventory, int par2, int par3, int par4) {

src/main/java/crazypants/enderio/conduit/gui/PacketFluidChannel.java

@@ -49,6 +49,7 @@ public class PacketFluidChannel extends AbstractConduitPacket<ILiquidConduit>
 
     @Override
     public IMessage onMessage(PacketFluidChannel message, MessageContext ctx) {
+        if (isInvalidPacketForGui(message, ctx)) return null;
         ILiquidConduit conduit = message.getTileCasted(ctx);
         if (!(conduit instanceof AbstractEnderLiquidConduit)) {
             return null;

src/main/java/crazypants/enderio/conduit/gui/PacketFluidFilter.java

@@ -53,6 +53,7 @@ public class PacketFluidFilter extends AbstractConduitPacket<ILiquidConduit>
 
     @Override
     public IMessage onMessage(PacketFluidFilter message, MessageContext ctx) {
+        if (isInvalidPacketForGui(message, ctx)) return null;
         ILiquidConduit conduit = message.getTileCasted(ctx);
         if (!(conduit instanceof AbstractEnderLiquidConduit)) {
             return null;

src/main/java/crazypants/enderio/conduit/gui/item/PacketExistingItemFilterSnapshot.java

@@ -58,6 +58,7 @@ public class PacketExistingItemFilterSnapshot extends AbstractConduitPacket<IIte
 
     @Override
     public PacketExistingItemFilterSnapshot onMessage(PacketExistingItemFilterSnapshot message, MessageContext ctx) {
+        if (isInvalidPacketForGui(message, ctx)) return null;
         IItemConduit conduit = message.getTileCasted(ctx);
         if (conduit == null) {
             return null;

src/main/java/crazypants/enderio/conduit/gui/item/PacketModItemFilter.java

@@ -58,6 +58,7 @@ public class PacketModItemFilter extends AbstractConduitPacket<IItemConduit>
 
     @Override
     public IMessage onMessage(PacketModItemFilter message, MessageContext ctx) {
+        if (isInvalidPacketForGui(message, ctx)) return null;
         IItemConduit conduit = message.getTileCasted(ctx);
         if (conduit == null) {
             return null;

src/main/java/crazypants/enderio/conduit/packet/AbstractConduitPacket.java

@@ -6,6 +6,7 @@ import net.minecraft.world.World;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
 import crazypants.enderio.conduit.IConduit;
 import crazypants.enderio.conduit.IConduitBundle;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class AbstractConduitPacket<T extends IConduit> extends AbstractConduitBundlePacket {
@@ -50,4 +51,12 @@ public class AbstractConduitPacket<T extends IConduit> extends AbstractConduitBu
         IConduitBundle bundle = (IConduitBundle) te;
         return (T) bundle.getConduit(getConType());
     }
+
+    /**
+     * Validates if TileEntity received from client is actually the one player is interacting with. It prevents
+     * malicious user disturbing random machine settings etc.
+     */
+    protected static boolean isInvalidPacketForGui(AbstractConduitPacket<?> message, MessageContext ctx) {
+        return PacketUtil.isInvalidPacketForGui(ctx, message.getTileEntity(message.getWorld(ctx)), message.getClass());
+    }
 }

src/main/java/crazypants/enderio/conduit/packet/PacketConnectionMode.java

@@ -40,6 +40,7 @@ public class PacketConnectionMode extends AbstractConduitPacket<IConduit>
 
     @Override
     public IMessage onMessage(PacketConnectionMode message, MessageContext ctx) {
+        if (isInvalidPacketForGui(message, ctx)) return null;
         IConduit conduit = message.getTileCasted(ctx);
         if (conduit == null) {
             return null;

src/main/java/crazypants/enderio/conduit/packet/PacketExtractMode.java

@@ -45,6 +45,7 @@ public class PacketExtractMode extends AbstractConduitPacket<IExtractor>
 
     @Override
     public IMessage onMessage(PacketExtractMode message, MessageContext ctx) {
+        if (isInvalidPacketForGui(message, ctx)) return null;
         message.getTileCasted(ctx).setExtractionRedstoneMode(message.mode, message.dir);
         message.getTileCasted(ctx).setExtractionSignalColor(message.dir, message.color);
         message.getWorld(ctx).markBlockForUpdate(message.x, message.y, message.z);

src/main/java/crazypants/enderio/conduit/packet/PacketItemConduitFilter.java

@@ -68,6 +68,7 @@ public class PacketItemConduitFilter extends AbstractConduitPacket<IItemConduit>
 
     @Override
     public IMessage onMessage(PacketItemConduitFilter message, MessageContext ctx) {
+        if (isInvalidPacketForGui(message, ctx)) return null;
         IItemConduit conduit = message.getTileCasted(ctx);
         conduit.setSelfFeedEnabled(message.dir, message.loopMode);
         conduit.setRoundRobinEnabled(message.dir, message.roundRobin);

src/main/java/crazypants/enderio/conduit/packet/PacketOCConduitSignalColor.java

@@ -40,6 +40,7 @@ public class PacketOCConduitSignalColor extends AbstractConduitPacket<IOCConduit
 
     @Override
     public IMessage onMessage(PacketOCConduitSignalColor message, MessageContext ctx) {
+        if (isInvalidPacketForGui(message, ctx)) return null;
         message.getTileCasted(ctx).setSignalColor(message.dir, message.col);
         message.getWorld(ctx).markBlockForUpdate(message.x, message.y, message.z);
         return null;

src/main/java/crazypants/enderio/conduit/packet/PacketRedstoneConduitOutputStrength.java

@@ -38,6 +38,7 @@ public class PacketRedstoneConduitOutputStrength extends AbstractConduitPacket<I
 
     @Override
     public IMessage onMessage(PacketRedstoneConduitOutputStrength message, MessageContext ctx) {
+        if (isInvalidPacketForGui(message, ctx)) return null;
         IInsulatedRedstoneConduit tile = message.getTileCasted(ctx);
         if (tile != null) {
             tile.setOutputStrength(message.dir, message.isStrong);

src/main/java/crazypants/enderio/conduit/packet/PacketRedstoneConduitSignalColor.java

@@ -40,6 +40,7 @@ public class PacketRedstoneConduitSignalColor extends AbstractConduitPacket<IIns
 
     @Override
     public IMessage onMessage(PacketRedstoneConduitSignalColor message, MessageContext ctx) {
+        if (isInvalidPacketForGui(message, ctx)) return null;
         message.getTileCasted(ctx).setSignalColor(message.dir, message.col);
         message.getWorld(ctx).markBlockForUpdate(message.x, message.y, message.z);
         return null;

src/main/java/crazypants/enderio/conduit/packet/PacketRoundRobinMode.java

@@ -39,6 +39,7 @@ public class PacketRoundRobinMode extends AbstractConduitPacket<ILiquidConduit>
 
     @Override
     public IMessage onMessage(PacketRoundRobinMode message, MessageContext ctx) {
+        if (isInvalidPacketForGui(message, ctx)) return null;
         final ILiquidConduit conduit = message.getTileCasted(ctx);
         if (conduit instanceof AbstractEnderLiquidConduit) {
             ((AbstractEnderLiquidConduit) conduit).setRoundRobin(message.dir, message.roundRobin);

src/main/java/crazypants/enderio/config/Config.java

@@ -563,6 +563,8 @@ public final class Config {
     public static float inventoryPanelExtractCostPerItem = 12.0f;
     public static float inventoryPanelExtractCostPerOperation = 32.0f;
 
+    public static boolean strictTPItemChecking = true;
+
     public static void load(FMLPreInitializationEvent event) {
         PacketHandler.INSTANCE
                 .registerMessage(PacketConfigSync.class, PacketConfigSync.class, PacketHandler.nextID(), Side.CLIENT);
@@ -2884,6 +2886,12 @@ public final class Config {
                 0.0f,
                 10000.0f,
                 "Internal power used per extract operation (independent of stack size)");
+        strictTPItemChecking = config.get(
+                sectionMisc.name,
+                "strictTPItemChecking",
+                strictTPItemChecking,
+                "If true, turn on strict checking of item energy checking. This might cause traveling tools from third party mods to fire fake security warnings on server side and not function correctly.")
+                .getBoolean(strictTPItemChecking);
     }
 
     public static void checkYetaAccess() {

src/main/java/crazypants/enderio/item/darksteel/ItemDarkSteelPickaxe.java

@@ -331,6 +331,11 @@ public class ItemDarkSteelPickaxe extends ItemPickaxe
         extractEnergy(equipped, power, false);
     }
 
+    @Override
+    public int canExtractInternal(ItemStack equipped, int power) {
+        return extractEnergy(equipped, power, true);
+    }
+
     private boolean isTravelUpgradeActive(EntityPlayer ep, ItemStack equipped) {
         return isEquipped(ep) && ep.isSneaking() && TravelUpgrade.loadFromItem(equipped) != null;
     }

src/main/java/crazypants/enderio/item/darksteel/ItemDarkSteelSword.java

@@ -394,6 +394,11 @@ public class ItemDarkSteelSword extends ItemSword
         extractEnergy(equipped, power, false);
     }
 
+    @Override
+    public int canExtractInternal(ItemStack equipped, int power) {
+        return extractEnergy(equipped, power, true);
+    }
+
     private boolean isTravelUpgradeActive(EntityPlayer ep, ItemStack equipped) {
         return isEquipped(ep) && ep.isSneaking() && TravelUpgrade.loadFromItem(equipped) != null;
     }

src/main/java/crazypants/enderio/machine/ContainerNoInv.java

@@ -2,19 +2,25 @@ package crazypants.enderio.machine;
 
 import net.minecraft.entity.player.EntityPlayer;
 import net.minecraft.inventory.Container;
-import net.minecraft.inventory.IInventory;
+import net.minecraft.tileentity.TileEntity;
 
-public class ContainerNoInv extends Container {
+import crazypants.enderio.machine.gui.IContainerWithTileEntity;
 
-    private IInventory inv;
+public class ContainerNoInv extends Container implements IContainerWithTileEntity {
 
-    public ContainerNoInv(IInventory inv) {
-        super();
-        this.inv = inv;
+    private final AbstractMachineEntity tile;
+
+    public ContainerNoInv(AbstractMachineEntity tile) {
+        this.tile = tile;
     }
 
     @Override
     public boolean canInteractWith(EntityPlayer player) {
-        return inv.isUseableByPlayer(player);
+        return tile.isUseableByPlayer(player);
+    }
+
+    @Override
+    public TileEntity getTileEntity() {
+        return tile;
     }
 }

src/main/java/crazypants/enderio/machine/PacketIoMode.java

@@ -9,6 +9,7 @@ import com.enderio.core.common.util.BlockCoord;
 import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketIoMode implements IMessage, IMessageHandler<PacketIoMode, IMessage> {
@@ -61,6 +62,7 @@ public class PacketIoMode implements IMessage, IMessageHandler<PacketIoMode, IMe
     public IMessage onMessage(PacketIoMode message, MessageContext ctx) {
         EntityPlayer player = ctx.getServerHandler().playerEntity;
         TileEntity te = player.worldObj.getTileEntity(message.x, message.y, message.z);
+        if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
         if (te instanceof IIoConfigurable) {
             IIoConfigurable me = (IIoConfigurable) te;
             if (message.face == ForgeDirection.UNKNOWN) {

src/main/java/crazypants/enderio/machine/PacketItemBuffer.java

@@ -8,6 +8,7 @@ import com.enderio.core.common.util.BlockCoord;
 import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketItemBuffer implements IMessage, IMessageHandler<PacketItemBuffer, IMessage> {
@@ -47,6 +48,7 @@ public class PacketItemBuffer implements IMessage, IMessageHandler<PacketItemBuf
     public IMessage onMessage(PacketItemBuffer message, MessageContext ctx) {
         EntityPlayer player = ctx.getServerHandler().playerEntity;
         TileEntity te = player.worldObj.getTileEntity(message.x, message.y, message.z);
+        if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
         if (te instanceof IItemBuffer) {
             ((IItemBuffer) te).setBufferStacks(message.bufferStacks);
         }

src/main/java/crazypants/enderio/machine/PacketProgress.java

@@ -1,45 +0,0 @@
-package crazypants.enderio.machine;
-
-import net.minecraft.tileentity.TileEntity;
-
-import com.enderio.core.api.common.util.IProgressTile;
-import com.enderio.core.common.network.MessageTileEntity;
-
-import cpw.mods.fml.common.network.simpleimpl.IMessage;
-import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
-import cpw.mods.fml.common.network.simpleimpl.MessageContext;
-import crazypants.enderio.EnderIO;
-import io.netty.buffer.ByteBuf;
-
-public class PacketProgress extends MessageTileEntity<TileEntity> implements IMessageHandler<PacketProgress, IMessage> {
-
-    private float progress;
-
-    public PacketProgress() {}
-
-    public PacketProgress(IProgressTile tile) {
-        super(tile.getTileEntity());
-        progress = tile.getProgress();
-    }
-
-    @Override
-    public void toBytes(ByteBuf buf) {
-        super.toBytes(buf);
-        buf.writeFloat(progress);
-    }
-
-    @Override
-    public void fromBytes(ByteBuf buf) {
-        super.fromBytes(buf);
-        progress = buf.readFloat();
-    }
-
-    @Override
-    public IMessage onMessage(PacketProgress message, MessageContext ctx) {
-        TileEntity tile = message.getTileEntity(EnderIO.proxy.getClientWorld());
-        if (tile instanceof IProgressTile) {
-            ((IProgressTile) tile).setProgress(message.progress);
-        }
-        return null;
-    }
-}

src/main/java/crazypants/enderio/machine/PacketRedstoneMode.java

@@ -6,6 +6,7 @@ import net.minecraft.tileentity.TileEntity;
 import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketRedstoneMode implements IMessage, IMessageHandler<PacketRedstoneMode, IMessage> {
@@ -52,6 +53,7 @@ public class PacketRedstoneMode implements IMessage, IMessageHandler<PacketRedst
     public IMessage onMessage(PacketRedstoneMode message, MessageContext ctx) {
         EntityPlayer player = ctx.getServerHandler().playerEntity;
         TileEntity te = player.worldObj.getTileEntity(message.x, message.y, message.z);
+        if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
         if (te instanceof IRedstoneModeControlable) {
             IRedstoneModeControlable me = (IRedstoneModeControlable) te;
             me.setRedstoneControlMode(message.mode);

src/main/java/crazypants/enderio/machine/alloy/PacketClientState.java

@@ -5,6 +5,7 @@ import net.minecraft.tileentity.TileEntity;
 import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketClientState implements IMessage, IMessageHandler<PacketClientState, IMessage> {
@@ -43,6 +44,7 @@ public class PacketClientState implements IMessage, IMessageHandler<PacketClient
 
     public IMessage onMessage(PacketClientState message, MessageContext ctx) {
         TileEntity te = ctx.getServerHandler().playerEntity.worldObj.getTileEntity(message.x, message.y, message.z);
+        if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
         if (te instanceof TileAlloySmelter) {
             TileAlloySmelter me = (TileAlloySmelter) te;
             me.setMode(message.mode);

src/main/java/crazypants/enderio/machine/capbank/ContainerCapBank.java

@@ -10,15 +10,14 @@ import net.minecraft.item.ItemArmor;
 import net.minecraft.item.ItemStack;
 import net.minecraft.util.IIcon;
 
-import com.enderio.core.common.ContainerEnder;
-
 import cpw.mods.fml.relauncher.Side;
 import cpw.mods.fml.relauncher.SideOnly;
 import crazypants.enderio.machine.capbank.network.InventoryImpl;
+import crazypants.enderio.machine.gui.ContainerEnderTileEntity;
 import crazypants.util.BaublesUtil;
 import crazypants.util.ShadowInventory;
 
-public class ContainerCapBank extends ContainerEnder<TileCapBank> {
+public class ContainerCapBank extends ContainerEnderTileEntity<TileCapBank> {
 
     private InventoryImpl inv;
 

src/main/java/crazypants/enderio/machine/crafter/PacketCrafter.java

@@ -8,6 +8,7 @@ import cpw.mods.fml.common.network.ByteBufUtils;
 import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketCrafter extends MessageTileEntity<TileCrafter> implements IMessageHandler<PacketCrafter, IMessage> {
@@ -46,9 +47,8 @@ public class PacketCrafter extends MessageTileEntity<TileCrafter> implements IMe
     @Override
     public IMessage onMessage(PacketCrafter msg, MessageContext ctx) {
         TileCrafter te = msg.getTileEntity(ctx.getServerHandler().playerEntity.worldObj);
-        if (te != null) {
-            msg.execute(te);
-        }
+        if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
+        msg.execute(te);
         return null;
     }
 

src/main/java/crazypants/enderio/machine/enchanter/ContainerEnchanter.java

@@ -11,9 +11,10 @@ import net.minecraft.item.ItemStack;
 
 import com.enderio.core.client.gui.widget.GhostBackgroundItemSlot;
 import com.enderio.core.client.gui.widget.GhostSlot;
-import com.enderio.core.common.ContainerEnder;
 
-public class ContainerEnchanter extends ContainerEnder<TileEnchanter> {
+import crazypants.enderio.machine.gui.ContainerEnderTileEntity;
+
+public class ContainerEnchanter extends ContainerEnderTileEntity<TileEnchanter> {
 
     public ContainerEnchanter(EntityPlayer player, InventoryPlayer playerInv, TileEnchanter te) {
         super(playerInv, te);

src/main/java/crazypants/enderio/machine/farm/PacketFarmLockedSlot.java

@@ -5,6 +5,7 @@ import com.enderio.core.common.network.MessageTileEntity;
 import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketFarmLockedSlot extends MessageTileEntity<TileFarmStation>
@@ -34,9 +35,8 @@ public class PacketFarmLockedSlot extends MessageTileEntity<TileFarmStation>
     @Override
     public IMessage onMessage(PacketFarmLockedSlot message, MessageContext ctx) {
         TileFarmStation te = message.getTileEntity(message.getWorld(ctx));
-        if (te != null) {
-            te.toggleLockedState(message.buttonID);
-        }
+        if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
+        te.toggleLockedState(message.buttonID);
         return null;
     }
 }

src/main/java/crazypants/enderio/machine/gui/AbstractMachineContainer.java

@@ -11,13 +11,12 @@ import net.minecraft.inventory.Slot;
 import net.minecraft.item.ItemStack;
 
 import com.enderio.core.api.common.util.IProgressTile;
-import com.enderio.core.common.ContainerEnder;
 import com.enderio.core.common.util.Util;
 
 import crazypants.enderio.machine.AbstractMachineEntity;
 import crazypants.enderio.machine.SlotDefinition;
 
-public abstract class AbstractMachineContainer<T extends AbstractMachineEntity> extends ContainerEnder<T> {
+public abstract class AbstractMachineContainer<T extends AbstractMachineEntity> extends ContainerEnderTileEntity<T> {
 
     protected Slot upgradeSlot;
 

src/main/java/crazypants/enderio/machine/gui/ContainerEnderTileEntity.java

@@ -0,0 +1,20 @@
+package crazypants.enderio.machine.gui;
+
+import net.minecraft.entity.player.InventoryPlayer;
+import net.minecraft.inventory.IInventory;
+import net.minecraft.tileentity.TileEntity;
+
+import com.enderio.core.common.ContainerEnder;
+
+public class ContainerEnderTileEntity<T extends TileEntity & IInventory> extends ContainerEnder<T>
+        implements IContainerWithTileEntity {
+
+    public ContainerEnderTileEntity(InventoryPlayer playerInv, T inv) {
+        super(playerInv, inv);
+    }
+
+    @Override
+    public TileEntity getTileEntity() {
+        return getInv();
+    }
+}

src/main/java/crazypants/enderio/machine/gui/IContainerWithTileEntity.java

@@ -0,0 +1,13 @@
+package crazypants.enderio.machine.gui;
+
+import net.minecraft.tileentity.TileEntity;
+
+/**
+ * Container implementing this interface holds TileEntity player is interacting with.
+ *
+ * @see crazypants.enderio.network.PacketUtil#isInvalidPacketForGui
+ */
+public interface IContainerWithTileEntity {
+
+    TileEntity getTileEntity();
+}

src/main/java/crazypants/enderio/machine/hypercube/PacketClientState.java

@@ -14,6 +14,7 @@ import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
 import crazypants.enderio.machine.hypercube.TileHyperCube.IoMode;
 import crazypants.enderio.machine.hypercube.TileHyperCube.SubChannel;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketClientState implements IMessage, IMessageHandler<PacketClientState, IMessage> {
@@ -88,6 +89,7 @@ public class PacketClientState implements IMessage, IMessageHandler<PacketClient
     public IMessage onMessage(PacketClientState message, MessageContext ctx) {
         EntityPlayer player = ctx.getServerHandler().playerEntity;
         TileEntity te = player.worldObj.getTileEntity(message.x, message.y, message.z);
+        if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
         if (te instanceof TileHyperCube) {
             TileHyperCube hc = (TileHyperCube) te;
 

src/main/java/crazypants/enderio/machine/invpanel/PacketRequestMissingItems.java

@@ -18,6 +18,7 @@ import cpw.mods.fml.common.network.simpleimpl.MessageContext;
 import crazypants.enderio.machine.invpanel.server.InventoryDatabaseServer;
 import crazypants.enderio.machine.invpanel.server.ItemEntry;
 import crazypants.enderio.network.PacketHandler;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketRequestMissingItems extends MessageTileEntity<TileInventoryPanel>
@@ -62,6 +63,7 @@ public class PacketRequestMissingItems extends MessageTileEntity<TileInventoryPa
     public IMessage onMessage(PacketRequestMissingItems message, MessageContext ctx) {
         EntityPlayerMP player = ctx.getServerHandler().playerEntity;
         TileEntity te = player.worldObj.getTileEntity(message.x, message.y, message.z);
+        if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
         if (te instanceof TileInventoryPanel) {
             TileInventoryPanel teInvPanel = (TileInventoryPanel) te;
             InventoryDatabaseServer db = teInvPanel.getDatabaseServer();

src/main/java/crazypants/enderio/machine/invpanel/PacketSetExtractionDisabled.java

@@ -8,6 +8,7 @@ import com.enderio.core.common.network.MessageTileEntity;
 import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketSetExtractionDisabled extends MessageTileEntity<TileInventoryPanel>
@@ -38,6 +39,7 @@ public class PacketSetExtractionDisabled extends MessageTileEntity<TileInventory
     public IMessage onMessage(PacketSetExtractionDisabled message, MessageContext ctx) {
         EntityPlayerMP player = ctx.getServerHandler().playerEntity;
         TileEntity te = player.worldObj.getTileEntity(message.x, message.y, message.z);
+        if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
         if (te instanceof TileInventoryPanel) {
             TileInventoryPanel teInvPanel = (TileInventoryPanel) te;
             teInvPanel.setExtractionDisabled(message.extractionDisabled);

src/main/java/crazypants/enderio/machine/monitor/PacketPowerMonitor.java

@@ -7,6 +7,7 @@ import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
 import crazypants.enderio.Log;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketPowerMonitor implements IMessage, IMessageHandler<PacketPowerMonitor, IMessage> {
@@ -58,6 +59,7 @@ public class PacketPowerMonitor implements IMessage, IMessageHandler<PacketPower
             return null;
         }
         TilePowerMonitor pm = (TilePowerMonitor) te;
+        if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
         pm.engineControlEnabled = message.engineControlEnabled;
         pm.startLevel = message.startLevel;
         pm.stopLevel = message.stopLevel;

src/main/java/crazypants/enderio/machine/obelisk/weather/PacketActivateWeather.java

@@ -6,6 +6,7 @@ import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
 import crazypants.enderio.EnderIO;
+import crazypants.enderio.network.PacketUtil;
 
 public class PacketActivateWeather extends MessageTileEntity<TileWeatherObelisk>
         implements IMessageHandler<PacketActivateWeather, IMessage> {
@@ -22,6 +23,7 @@ public class PacketActivateWeather extends MessageTileEntity<TileWeatherObelisk>
                 .getTileEntity(ctx.side.isServer() ? message.getWorld(ctx) : EnderIO.proxy.getClientWorld());
         if (te != null) {
             if (ctx.side.isServer()) {
+                if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
                 te.startTask();
             } else {
                 te.stopTask();

src/main/java/crazypants/enderio/machine/obelisk/xp/BlockExperienceObelisk.java

@@ -3,7 +3,6 @@ package crazypants.enderio.machine.obelisk.xp;
 import java.util.Random;
 
 import net.minecraft.entity.player.EntityPlayer;
-import net.minecraft.inventory.IInventory;
 import net.minecraft.item.ItemStack;
 import net.minecraft.tileentity.TileEntity;
 import net.minecraft.util.IIcon;
@@ -49,7 +48,7 @@ public class BlockExperienceObelisk extends BlockObeliskAbstract<TileExperienceO
     public Object getServerGuiElement(int ID, EntityPlayer player, World world, int x, int y, int z) {
         TileEntity te = world.getTileEntity(x, y, z);
         if (te instanceof TileExperienceObelisk) {
-            return new ContainerNoInv((IInventory) te);
+            return new ContainerNoInv((TileExperienceObelisk) te);
         }
         return null;
     }

src/main/java/crazypants/enderio/machine/painter/TileEntityPainter.java

@@ -96,9 +96,10 @@ public class TileEntityPainter extends AbstractPoweredTaskEntity implements ISid
             // next result is a different item type
             return 0;
         } else if (result.hasTagCompound() && inventory[2].hasTagCompound()) {
-            int cookedId = result.getTagCompound().getInteger(BlockPainter.KEY_SOURCE_BLOCK_ID);
-            int invId = inventory[2].getTagCompound().getInteger(BlockPainter.KEY_SOURCE_BLOCK_ID);
-            if (cookedId != invId) {
+            if (inventory[2].getTagCompound().hasKey("Items")) return 0; // presence of internal items
+            String cookedId = result.getTagCompound().getString(BlockPainter.KEY_SOURCE_BLOCK_ID);
+            String invId = inventory[2].getTagCompound().getString(BlockPainter.KEY_SOURCE_BLOCK_ID);
+            if (!cookedId.equals(invId)) {
                 // next result has a different source item than the current one
                 return 0;
             }

src/main/java/crazypants/enderio/machine/power/PacketClientState.java

@@ -7,6 +7,7 @@ import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
 import crazypants.enderio.machine.RedstoneControlMode;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketClientState implements IMessage, IMessageHandler<PacketClientState, IMessage> {
@@ -62,6 +63,7 @@ public class PacketClientState implements IMessage, IMessageHandler<PacketClient
     public IMessage onMessage(PacketClientState message, MessageContext ctx) {
         EntityPlayer player = ctx.getServerHandler().playerEntity;
         TileEntity te = player.worldObj.getTileEntity(message.x, message.y, message.z);
+        if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
         if (te instanceof TileCapacitorBank) {
             TileCapacitorBank cb = (TileCapacitorBank) te;
             cb.setInputControlMode(message.inputMode);

src/main/java/crazypants/enderio/machine/spawner/PacketMode.java

@@ -5,6 +5,7 @@ import net.minecraft.tileentity.TileEntity;
 import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketMode implements IMessage, IMessageHandler<PacketMode, IMessage> {
@@ -43,6 +44,7 @@ public class PacketMode implements IMessage, IMessageHandler<PacketMode, IMessag
     @Override
     public IMessage onMessage(PacketMode message, MessageContext ctx) {
         TileEntity te = ctx.getServerHandler().playerEntity.worldObj.getTileEntity(message.x, message.y, message.z);
+        if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
         if (te instanceof TilePoweredSpawner) {
             TilePoweredSpawner me = (TilePoweredSpawner) te;
             me.setSpawnMode(message.isSpawnMode);

src/main/java/crazypants/enderio/machine/tank/PacketTankVoidMode.java

@@ -6,6 +6,7 @@ import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
 import crazypants.enderio.machine.tank.GuiTank.VoidMode;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketTankVoidMode extends MessageTileEntity<TileTank>
@@ -35,9 +36,8 @@ public class PacketTankVoidMode extends MessageTileEntity<TileTank>
     @Override
     public IMessage onMessage(PacketTankVoidMode message, MessageContext ctx) {
         TileTank te = message.getTileEntity(ctx.getServerHandler().playerEntity.worldObj);
-        if (te != null) {
-            te.setVoidMode(message.mode);
-        }
+        if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
+        te.setVoidMode(message.mode);
         return null;
     }
 }

src/main/java/crazypants/enderio/machine/transceiver/PacketItemFilter.java

@@ -10,6 +10,7 @@ import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
 import crazypants.enderio.conduit.item.filter.ItemFilter;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketItemFilter extends MessageTileEntity<TileTransceiver>
@@ -52,9 +53,10 @@ public class PacketItemFilter extends MessageTileEntity<TileTransceiver>
     public IMessage onMessage(PacketItemFilter message, MessageContext ctx) {
         EntityPlayer player = ctx.getServerHandler().playerEntity;
         TileTransceiver tile = message.getTileEntity(player.worldObj);
+        if (PacketUtil.isInvalidPacketForGui(ctx, tile, getClass())) return null;
         boolean isSend = message.isSend;
         ItemFilter filter = message.filter;
-        if (tile != null && filter != null) {
+        if (filter != null) {
             if (isSend) {
                 tile.setSendItemFilter(filter);
             } else {

src/main/java/crazypants/enderio/machine/transceiver/PacketSendRecieveChannel.java

@@ -9,6 +9,7 @@ import com.enderio.core.common.network.NetworkUtil;
 import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketSendRecieveChannel extends MessageTileEntity<TileTransceiver>
@@ -50,10 +51,11 @@ public class PacketSendRecieveChannel extends MessageTileEntity<TileTransceiver>
     public IMessage onMessage(PacketSendRecieveChannel message, MessageContext ctx) {
         EntityPlayer player = ctx.getServerHandler().playerEntity;
         TileTransceiver tile = message.getTileEntity(player.worldObj);
+        if (PacketUtil.isInvalidPacketForGui(ctx, tile, getClass())) return null;
         Channel channel = message.channel;
         boolean isSend = message.isSend;
         boolean isAdd = message.isAdd;
-        if (tile != null && channel != null) {
+        if (channel != null) {
             if (isSend) {
                 if (isAdd) {
                     tile.addSendChanel(channel);

src/main/java/crazypants/enderio/machine/vacuum/ContainerVacuumChest.java

@@ -10,11 +10,11 @@ import net.minecraft.item.ItemStack;
 
 import com.enderio.core.client.gui.widget.GhostBackgroundItemSlot;
 import com.enderio.core.client.gui.widget.GhostSlot;
-import com.enderio.core.common.ContainerEnder;
 
 import crazypants.enderio.EnderIO;
+import crazypants.enderio.machine.gui.ContainerEnderTileEntity;
 
-public class ContainerVacuumChest extends ContainerEnder<TileVacuumChest> {
+public class ContainerVacuumChest extends ContainerEnderTileEntity<TileVacuumChest> {
 
     private Slot filterSlot;
     private Runnable filterChangedCB;

src/main/java/crazypants/enderio/machine/vacuum/PacketVaccumChest.java

@@ -8,6 +8,7 @@ import cpw.mods.fml.common.network.ByteBufUtils;
 import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketVaccumChest extends MessageTileEntity<TileVacuumChest>
@@ -77,21 +78,20 @@ public class PacketVaccumChest extends MessageTileEntity<TileVacuumChest>
     @Override
     public IMessage onMessage(PacketVaccumChest msg, MessageContext ctx) {
         TileVacuumChest te = msg.getTileEntity(ctx.getServerHandler().playerEntity.worldObj);
-        if (te != null) {
-            switch (msg.cmd) {
-                case CMD_SET_RANGE:
-                    te.setRange(msg.value);
-                    break;
-                case CMD_SET_SLOT:
-                    te.setItemFilterSlot(msg.value, msg.stack);
-                    break;
-                case CMD_SET_BLACKLIST:
-                    te.setFilterBlacklist(msg.value != 0);
-                    break;
-                case CMD_SET_MATCHMETA:
-                    te.setFilterMatchMeta(msg.value != 0);
-                    break;
-            }
+        if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
+        switch (msg.cmd) {
+            case CMD_SET_RANGE:
+                te.setRange(msg.value);
+                break;
+            case CMD_SET_SLOT:
+                te.setItemFilterSlot(msg.value, msg.stack);
+                break;
+            case CMD_SET_BLACKLIST:
+                te.setFilterBlacklist(msg.value != 0);
+                break;
+            case CMD_SET_MATCHMETA:
+                te.setFilterMatchMeta(msg.value != 0);
+                break;
         }
         return null;
     }

src/main/java/crazypants/enderio/machine/vat/PacketDumpTank.java

@@ -7,6 +7,7 @@ import com.enderio.core.common.network.MessageTileEntity;
 import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketDumpTank extends MessageTileEntity<TileVat> implements IMessageHandler<PacketDumpTank, IMessage> {
@@ -47,9 +48,8 @@ public class PacketDumpTank extends MessageTileEntity<TileVat> implements IMessa
     @Override
     public IMessage onMessage(PacketDumpTank message, MessageContext ctx) {
         TileVat te = message.getTileEntity(ctx.getServerHandler().playerEntity.worldObj);
-        if (te != null) {
-            message.getTank(te).setFluid(null);
-        }
+        if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
+        message.getTank(te).setFluid(null);
         return null;
     }
 }

src/main/java/crazypants/enderio/network/PacketUtil.java

@@ -0,0 +1,54 @@
+package crazypants.enderio.network;
+
+import net.minecraft.entity.player.EntityPlayer;
+import net.minecraft.inventory.Container;
+import net.minecraft.tileentity.TileEntity;
+
+import cpw.mods.fml.common.network.simpleimpl.MessageContext;
+import cpw.mods.fml.relauncher.Side;
+import crazypants.enderio.Log;
+import crazypants.enderio.machine.gui.IContainerWithTileEntity;
+
+public class PacketUtil {
+
+    /**
+     * Validates if TileEntity received from client is actually the one player is interacting with. It prevents
+     * malicious user disturbing random machine settings etc.
+     */
+    public static boolean isInvalidPacketForGui(MessageContext ctx, TileEntity receivedTile, Class<?> messageClass) {
+        if (receivedTile == null) {
+            // Invalid, but not harmful
+            return true;
+        }
+        if (ctx.side == Side.CLIENT) return false;
+        EntityPlayer player = ctx.getServerHandler().playerEntity;
+        Container container = player.openContainer;
+        if (!(container instanceof IContainerWithTileEntity)) {
+            Log.LOGGER.warn(
+                    Log.securityMarker,
+                    "Player {} tried to send {} while not opening correct GUI. Target TileEntity at {}, {}, {}",
+                    player.getGameProfile(),
+                    messageClass.getSimpleName(),
+                    receivedTile.xCoord,
+                    receivedTile.yCoord,
+                    receivedTile.zCoord);
+            return true;
+        }
+        TileEntity expectedTile = ((IContainerWithTileEntity) container).getTileEntity();
+        if (receivedTile != expectedTile) {
+            Log.LOGGER.warn(
+                    Log.securityMarker,
+                    "Player {} tried to send {} which attempts to modify setting of TileEntity at {}, {}, {}. Expected: {}, {}, {}",
+                    player.getGameProfile(),
+                    messageClass.getSimpleName(),
+                    receivedTile.xCoord,
+                    receivedTile.yCoord,
+                    receivedTile.zCoord,
+                    expectedTile.xCoord,
+                    expectedTile.yCoord,
+                    expectedTile.zCoord);
+            return true;
+        }
+        return false;
+    }
+}

src/main/java/crazypants/enderio/teleport/ContainerTravelAccessable.java

@@ -15,10 +15,11 @@ import com.enderio.core.common.ContainerEnder;
 import com.enderio.core.common.TileEntityEnder;
 
 import crazypants.enderio.api.teleport.ITravelAccessable;
+import crazypants.enderio.machine.gui.IContainerWithTileEntity;
 import crazypants.enderio.network.PacketHandler;
 import crazypants.enderio.teleport.packet.PacketPassword;
 
-public class ContainerTravelAccessable extends ContainerEnder<IInventory> {
+public class ContainerTravelAccessable extends ContainerEnder<IInventory> implements IContainerWithTileEntity {
 
     ITravelAccessable ta;
     TileEntity te;
@@ -97,4 +98,9 @@ public class ContainerTravelAccessable extends ContainerEnder<IInventory> {
             }
         }
     }
+
+    @Override
+    public TileEntity getTileEntity() {
+        return te;
+    }
 }

src/main/java/crazypants/enderio/teleport/ContainerTravelAuth.java

@@ -6,14 +6,16 @@ import java.util.List;
 import net.minecraft.entity.player.EntityPlayer;
 import net.minecraft.entity.player.InventoryPlayer;
 import net.minecraft.item.ItemStack;
+import net.minecraft.tileentity.TileEntity;
 
 import com.enderio.core.client.gui.widget.GhostSlot;
 import com.enderio.core.common.ContainerEnder;
 import com.enderio.core.common.util.ArrayInventory;
 
+import crazypants.enderio.machine.gui.IContainerWithTileEntity;
 import crazypants.enderio.teleport.ContainerTravelAuth.AuthInventory;
 
-public class ContainerTravelAuth extends ContainerEnder<AuthInventory> {
+public class ContainerTravelAuth extends ContainerEnder<AuthInventory> implements IContainerWithTileEntity {
 
     static class AuthInventory extends ArrayInventory {
 
@@ -87,10 +89,12 @@ public class ContainerTravelAuth extends ContainerEnder<AuthInventory> {
         }
     }
 
+    private final TileEntity te;
     boolean dirty = false;
 
-    public ContainerTravelAuth(InventoryPlayer playerInv) {
+    public ContainerTravelAuth(InventoryPlayer playerInv, TileEntity te) {
         super(playerInv, new AuthInventory(new ItemStack[5]));
+        this.te = te;
         getInv().setContainer(this);
     }
 
@@ -118,6 +122,11 @@ public class ContainerTravelAuth extends ContainerEnder<AuthInventory> {
         return null;
     }
 
+    @Override
+    public TileEntity getTileEntity() {
+        return te;
+    }
+
     private static class AuthGhostSlot extends GhostSlot {
 
         private AuthInventory inv;

src/main/java/crazypants/enderio/teleport/GuiTravelAuth.java

@@ -5,6 +5,7 @@ import java.awt.Color;
 import net.minecraft.client.gui.GuiButton;
 import net.minecraft.client.gui.GuiScreen;
 import net.minecraft.entity.player.EntityPlayer;
+import net.minecraft.tileentity.TileEntity;
 import net.minecraft.world.World;
 
 import org.lwjgl.opengl.GL11;
@@ -24,7 +25,7 @@ public class GuiTravelAuth extends GuiContainerBaseEIO {
     private final EntityPlayer player;
 
     public GuiTravelAuth(EntityPlayer player, ITravelAccessable te, World world) {
-        super(new ContainerTravelAuth(player.inventory), "travelAuth");
+        super(new ContainerTravelAuth(player.inventory, (TileEntity) te), "travelAuth");
         this.ta = te;
         title = EnderIO.lang.localize("gui.travelAccessable.enterCode");
         this.player = player;

src/main/java/crazypants/enderio/teleport/ItemTeleportStaff.java

@@ -84,6 +84,11 @@ public class ItemTeleportStaff extends ItemTravelStaff {
         // Do nothing, as we have infinite energy.
     }
 
+    @Override
+    public int canExtractInternal(ItemStack equipped, int power) {
+        return power;
+    }
+
     @Override
     @SideOnly(Side.CLIENT)
     public void getSubItems(Item item, CreativeTabs par2CreativeTabs, List par3List) {

src/main/java/crazypants/enderio/teleport/ItemTravelStaff.java

@@ -132,6 +132,11 @@ public class ItemTravelStaff extends ItemEnergyContainer implements IItemOfTrave
         setEnergy(item, res);
     }
 
+    @Override
+    public int canExtractInternal(ItemStack equipped, int power) {
+        return Math.min(getEnergyStored(equipped), power);
+    }
+
     void setEnergy(ItemStack container, int energy) {
         if (container.stackTagCompound == null) {
             container.stackTagCompound = new NBTTagCompound();

src/main/java/crazypants/enderio/teleport/TravelController.java

@@ -111,6 +111,47 @@ public class TravelController {
         }
     }
 
+    public boolean validatePacketTravelEvent(EntityPlayerMP toTp, int x, int y, int z, int powerUse,
+            boolean conserveMotion, TravelSource source) {
+        BlockCoord target = new BlockCoord(x, y, z);
+        double dist = getDistanceSquared(toTp, target);
+        // allow 15% overshoot to account for rounding
+        if (dist * 100 > source.getMaxDistanceTravelledSq() * 115) return false;
+        if (powerUse < getRequiredPower(toTp, source, target)) return false;
+        ItemStack equippedItem = toTp.getCurrentEquippedItem();
+        switch (source) {
+            case TELEPAD:
+                // this source is invalid for this type of packet
+                return false;
+            case BLOCK:
+                // this source is only triggered when player is on any active travel anchor
+                BlockCoord on = getActiveTravelBlock(toTp);
+                if (on == null) return false;
+                // target must be a valid selectedCoord
+                // selectedCoord can either be a block right above/below when the player is on anchor...
+                if (on.x == x && on.z == z) return true;
+                // or another anchor
+                TileEntity maybeAnchor = target.getTileEntity(toTp.worldObj);
+                if (!(maybeAnchor instanceof ITravelAccessable)) return false;
+                ITravelAccessable anchor = (ITravelAccessable) maybeAnchor;
+                return anchor.canBlockBeAccessed(toTp) || !isValidTarget(toTp, target, TravelSource.BLOCK);
+            case STAFF:
+            case STAFF_BLINK:
+                if (equippedItem == null || !(equippedItem.getItem() instanceof IItemOfTravel)) return false;
+                if (!((IItemOfTravel) equippedItem.getItem()).isActive(toTp, equippedItem)) return false;
+                int energy = ((IItemOfTravel) equippedItem.getItem()).canExtractInternal(equippedItem, powerUse);
+                return energy == -1 || energy == powerUse;
+            case TELEPORT_STAFF_BLINK:
+            case TELEPORT_STAFF:
+                // tp staff is creative version of traveling staff
+                // no energy check or anything else needed
+                // but the player must actually be equipped with one of these
+                return equippedItem != null && equippedItem.getItem() instanceof ItemTeleportStaff;
+            default:
+                throw new AssertionError("unidentified travel source");
+        }
+    }
+
     public void addBlockToBlinkBlackList(String blockName) {
         blackList.add(new UniqueIdentifier(blockName));
     }
@@ -733,35 +774,41 @@ public class TravelController {
                 && y <= 255; i++, y += direction) {
 
             // Circumvents the raytracing used to find candidates on the y axis
-            TileEntity selectedBlock = world.getTileEntity(currentBlock.x, y, currentBlock.z);
-
-            if (selectedBlock instanceof ITravelAccessable) {
-                ITravelAccessable travelBlock = (ITravelAccessable) selectedBlock;
-                BlockCoord targetBlock = new BlockCoord(currentBlock.x, y, currentBlock.z);
-
-                if (Config.travelAnchorSkipWarning) {
-                    if (travelBlock.getRequiresPassword(player)) {
-                        showMessage(player, new ChatComponentTranslation("enderio.gui.travelAccessable.skipLocked"));
-                    }
-
-                    if (travelBlock.getAccessMode() == ITravelAccessable.AccessMode.PRIVATE
-                            && !travelBlock.canUiBeAccessed(player)) {
-                        showMessage(player, new ChatComponentTranslation("enderio.gui.travelAccessable.skipPrivate"));
-                    }
-                    if (!isValidTarget(player, targetBlock, TravelSource.BLOCK)) {
-                        showMessage(
-                                player,
-                                new ChatComponentTranslation("enderio.gui.travelAccessable.skipObstructed"));
-                    }
-                }
-                if (travelBlock.canBlockBeAccessed(player) && isValidTarget(player, targetBlock, TravelSource.BLOCK)) {
-                    selectedCoord = targetBlock;
-                    return;
-                }
+            BlockCoord targetBlock = getValidVerticalTarget(player, currentBlock, world, y);
+            if (targetBlock != null) {
+                selectedCoord = targetBlock;
+                return;
             }
         }
     }
 
+    private BlockCoord getValidVerticalTarget(EntityPlayer player, BlockCoord currentBlock, World world, int y) {
+        TileEntity selectedBlock = world.getTileEntity(currentBlock.x, y, currentBlock.z);
+
+        if (selectedBlock instanceof ITravelAccessable) {
+            ITravelAccessable travelBlock = (ITravelAccessable) selectedBlock;
+            BlockCoord targetBlock = new BlockCoord(currentBlock.x, y, currentBlock.z);
+
+            if (Config.travelAnchorSkipWarning) {
+                if (travelBlock.getRequiresPassword(player)) {
+                    showMessage(player, new ChatComponentTranslation("enderio.gui.travelAccessable.skipLocked"));
+                }
+
+                if (travelBlock.getAccessMode() == ITravelAccessable.AccessMode.PRIVATE
+                        && !travelBlock.canUiBeAccessed(player)) {
+                    showMessage(player, new ChatComponentTranslation("enderio.gui.travelAccessable.skipPrivate"));
+                }
+                if (!isValidTarget(player, targetBlock, TravelSource.BLOCK)) {
+                    showMessage(player, new ChatComponentTranslation("enderio.gui.travelAccessable.skipObstructed"));
+                }
+            }
+            if (travelBlock.canBlockBeAccessed(player) && isValidTarget(player, targetBlock, TravelSource.BLOCK)) {
+                return targetBlock;
+            }
+        }
+        return null;
+    }
+
     @SideOnly(Side.CLIENT)
     private void updateSelectedTarget(EntityPlayer player) {
         selectedCoord = null;
@@ -923,19 +970,16 @@ public class TravelController {
         return true;
     }
 
-    @SideOnly(Side.CLIENT)
     private BlockCoord getActiveTravelBlock(EntityPlayer player) {
-        World world = Minecraft.getMinecraft().theWorld;
-        if (world != null && player != null) {
-            int x = MathHelper.floor_double(player.posX);
-            int y = MathHelper.floor_double(player.boundingBox.minY) - 1;
-            int z = MathHelper.floor_double(player.posZ);
-            TileEntity tileEntity = world.getTileEntity(x, y, z);
-            if (tileEntity instanceof ITravelAccessable) {
-                if (((ITravelAccessable) tileEntity).isTravelSource()) {
-                    return new BlockCoord(x, y, z);
-                }
-            }
+        if (player == null) return null;
+        World world = player.worldObj;
+        if (world == null) return null;
+        int x = MathHelper.floor_double(player.posX);
+        int y = MathHelper.floor_double(player.boundingBox.minY) - 1;
+        int z = MathHelper.floor_double(player.posZ);
+        TileEntity tileEntity = world.getTileEntity(x, y, z);
+        if (tileEntity instanceof ITravelAccessable && ((ITravelAccessable) tileEntity).isTravelSource()) {
+            return new BlockCoord(x, y, z);
         }
         return null;
     }

src/main/java/crazypants/enderio/teleport/anchor/BlockTravelAnchor.java

@@ -181,7 +181,7 @@ public class BlockTravelAnchor extends BlockEio
             if (ID == GuiHandler.GUI_ID_TRAVEL_ACCESSABLE) {
                 return new ContainerTravelAccessable(player.inventory, (ITravelAccessable) te, world);
             } else {
-                return new ContainerTravelAuth(player.inventory);
+                return new ContainerTravelAuth(player.inventory, te);
             }
         }
         return null;

src/main/java/crazypants/enderio/teleport/packet/PacketAccessMode.java

@@ -7,6 +7,7 @@ import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
 import crazypants.enderio.api.teleport.ITravelAccessable;
+import crazypants.enderio.network.PacketUtil;
 import crazypants.enderio.teleport.anchor.TileTravelAnchor;
 import io.netty.buffer.ByteBuf;
 
@@ -48,6 +49,7 @@ public class PacketAccessMode implements IMessage, IMessageHandler<PacketAccessM
     public IMessage onMessage(PacketAccessMode message, MessageContext ctx) {
         EntityPlayer player = ctx.getServerHandler().playerEntity;
         TileEntity te = player.worldObj.getTileEntity(message.x, message.y, message.z);
+        if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
         if (te instanceof ITravelAccessable) {
             ((ITravelAccessable) te).setAccessMode(message.mode);
             player.worldObj.markBlockForUpdate(message.x, message.y, message.z);

src/main/java/crazypants/enderio/teleport/packet/PacketLabel.java

@@ -8,6 +8,7 @@ import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
 import crazypants.enderio.api.teleport.ITravelAccessable;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketLabel implements IMessage, IMessageHandler<PacketLabel, IMessage> {
@@ -55,6 +56,7 @@ public class PacketLabel implements IMessage, IMessageHandler<PacketLabel, IMess
     public IMessage onMessage(PacketLabel message, MessageContext ctx) {
         EntityPlayer player = ctx.getServerHandler().playerEntity;
         TileEntity te = player.worldObj.getTileEntity(message.x, message.y, message.z);
+        if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
         if (te instanceof ITravelAccessable) {
             ((ITravelAccessable) te).setLabel(message.label);
             player.worldObj.markBlockForUpdate(message.x, message.y, message.z);

src/main/java/crazypants/enderio/teleport/packet/PacketLongDistanceTravelEvent.java

@@ -16,9 +16,11 @@ import com.enderio.core.common.vecmath.Vector3d;
 import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
+import crazypants.enderio.Log;
 import crazypants.enderio.api.teleport.IItemOfTravel;
 import crazypants.enderio.api.teleport.TeleportEntityEvent;
 import crazypants.enderio.api.teleport.TravelSource;
+import crazypants.enderio.teleport.ItemTeleportStaff;
 import crazypants.enderio.teleport.TravelController;
 import io.netty.buffer.ByteBuf;
 
@@ -53,16 +55,50 @@ public class PacketLongDistanceTravelEvent
 
     @Override
     public IMessage onMessage(PacketLongDistanceTravelEvent message, MessageContext ctx) {
-        Entity toTp = message.entityId == -1 ? ctx.getServerHandler().playerEntity
-                : ctx.getServerHandler().playerEntity.worldObj.getEntityByID(message.entityId);
+        if (message.entityId != -1) {
+            // after checking the code base, this type of packet won't be sent at all,
+            // so we can assume this to be an attempt to hack
+            Log.LOGGER.warn(
+                    Log.securityMarker,
+                    "Player {} tried to illegally tp other entity {}.",
+                    ctx.getServerHandler().playerEntity.getGameProfile(),
+                    message.entityId);
+            return null;
+        }
+        EntityPlayerMP toTp = ctx.getServerHandler().playerEntity;
 
         TravelSource source = TravelSource.values()[message.source];
 
+        if (!validate(toTp, source)) {
+            Log.LOGGER.warn(
+                    Log.securityMarker,
+                    "Player {} tried to tp without valid prereq.",
+                    ctx.getServerHandler().playerEntity.getGameProfile());
+            return null;
+        }
+
         doServerTeleport(toTp, message.conserveMotion, source);
 
         return null;
     }
 
+    private static boolean validate(EntityPlayerMP toTp, TravelSource source) {
+        ItemStack equippedItem = toTp.getCurrentEquippedItem();
+        switch (source) {
+            case STAFF:
+                return equippedItem != null && equippedItem.getItem() instanceof IItemOfTravel
+                        && ((IItemOfTravel) equippedItem.getItem()).isActive(toTp, equippedItem);
+            case TELEPORT_STAFF:
+                // tp staff is creative version of traveling staff
+                // no energy check or anything else needed
+                // but the player must actually be equipped with one of these
+                return equippedItem != null && equippedItem.getItem() instanceof ItemTeleportStaff;
+            default:
+                // all other types are not allowed
+                return false;
+        }
+    }
+
     public static boolean doServerTeleport(Entity toTp, boolean conserveMotion, TravelSource source) {
         EntityPlayer player = toTp instanceof EntityPlayer ? (EntityPlayer) toTp : null;
         Optional<BlockCoord> travelDestination = TravelController.instance.findTravelDestination(player, source);
@@ -77,6 +113,14 @@ public class PacketLongDistanceTravelEvent
         if (powerUse < 0) {
             return false;
         }
+        if (player != null && player.getCurrentEquippedItem() != null
+                && player.getCurrentEquippedItem().getItem() instanceof IItemOfTravel) {
+            int used = ((IItemOfTravel) player.getCurrentEquippedItem().getItem())
+                    .canExtractInternal(player.getCurrentEquippedItem(), powerUse);
+            if (used != -1 && used != powerUse) {
+                return false;
+            }
+        }
 
         TeleportEntityEvent evt = new TeleportEntityEvent(toTp, source, x, y, z);
         if (MinecraftForge.EVENT_BUS.post(evt)) {

src/main/java/crazypants/enderio/teleport/packet/PacketPassword.java

@@ -10,6 +10,7 @@ import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
 import crazypants.enderio.api.teleport.ITravelAccessable;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketPassword extends MessageTileEntity<TileEntityEnder> {
@@ -61,6 +62,7 @@ public class PacketPassword extends MessageTileEntity<TileEntityEnder> {
         @Override
         public IMessage onMessage(PacketPassword msg, MessageContext ctx) {
             TileEntityEnder te = msg.getTileEntity(ctx.getServerHandler().playerEntity.worldObj);
+            if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
             if (te instanceof ITravelAccessable) {
                 if (((ITravelAccessable) te).canUiBeAccessed(ctx.getServerHandler().playerEntity)) {
                     if (msg.stack != null) {

src/main/java/crazypants/enderio/teleport/packet/PacketTravelEvent.java

@@ -13,9 +13,11 @@ import com.enderio.core.common.vecmath.Vector3d;
 import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
+import crazypants.enderio.Log;
 import crazypants.enderio.api.teleport.IItemOfTravel;
 import crazypants.enderio.api.teleport.TeleportEntityEvent;
 import crazypants.enderio.api.teleport.TravelSource;
+import crazypants.enderio.teleport.TravelController;
 import io.netty.buffer.ByteBuf;
 
 public class PacketTravelEvent implements IMessage, IMessageHandler<PacketTravelEvent, IMessage> {
@@ -65,13 +67,31 @@ public class PacketTravelEvent implements IMessage, IMessageHandler<PacketTravel
 
     @Override
     public IMessage onMessage(PacketTravelEvent message, MessageContext ctx) {
-        Entity toTp = message.entityId == -1 ? ctx.getServerHandler().playerEntity
-                : ctx.getServerHandler().playerEntity.worldObj.getEntityByID(message.entityId);
+        if (message.entityId != -1) {
+            // after checking the code base, this type of packet won't be sent at all,
+            // so we can assume this to be an attempt to hack
+            Log.LOGGER.warn(
+                    Log.securityMarker,
+                    "Player {} tried to illegally tp other entity {}.",
+                    ctx.getServerHandler().playerEntity.getGameProfile(),
+                    message.entityId);
+            return null;
+        }
+        EntityPlayerMP toTp = ctx.getServerHandler().playerEntity;
 
         int x = message.x, y = message.y, z = message.z;
 
         TravelSource source = TravelSource.values()[message.source];
 
+        if (!TravelController.instance
+                .validatePacketTravelEvent(toTp, x, y, z, message.powerUse, message.conserveMotion, source)) {
+            Log.LOGGER.warn(
+                    Log.securityMarker,
+                    "Player {} tried to tp without valid prereq.",
+                    ctx.getServerHandler().playerEntity.getGameProfile());
+            return null;
+        }
+
         doServerTeleport(toTp, x, y, z, message.powerUse, message.conserveMotion, source);
 
         return null;

src/main/java/crazypants/enderio/teleport/packet/PacketVisibility.java

@@ -7,6 +7,7 @@ import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
 import crazypants.enderio.api.teleport.ITravelAccessable;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketVisibility implements IMessage, IMessageHandler<PacketVisibility, IMessage> {
@@ -44,6 +45,7 @@ public class PacketVisibility implements IMessage, IMessageHandler<PacketVisibil
     public IMessage onMessage(PacketVisibility message, MessageContext ctx) {
         EntityPlayer player = ctx.getServerHandler().playerEntity;
         TileEntity te = player.worldObj.getTileEntity(message.x, message.y, message.z);
+        if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
         if (te instanceof ITravelAccessable) {
             ((ITravelAccessable) te).setVisible(message.visible);
             player.worldObj.markBlockForUpdate(message.x, message.y, message.z);

src/main/java/crazypants/enderio/teleport/telepad/BlockTelePad.java

@@ -167,11 +167,11 @@ public class BlockTelePad extends BlockTravelAnchor {
         if (te instanceof TileTelePad) {
             switch (ID) {
                 case GuiHandler.GUI_ID_TELEPAD:
-                    return new ContainerTelePad(player.inventory);
+                    return new ContainerTelePad(player.inventory, (TileTelePad) te);
                 case GuiHandler.GUI_ID_TELEPAD_TRAVEL:
                     return new ContainerTravelAccessable(player.inventory, (TileTelePad) te, world);
                 default:
-                    return new ContainerTravelAuth(player.inventory);
+                    return new ContainerTravelAuth(player.inventory, te);
             }
         }
         return null;

src/main/java/crazypants/enderio/teleport/telepad/ContainerTelePad.java

@@ -4,13 +4,19 @@ import java.awt.Point;
 
 import net.minecraft.entity.player.InventoryPlayer;
 import net.minecraft.inventory.IInventory;
+import net.minecraft.tileentity.TileEntity;
 
 import com.enderio.core.common.ContainerEnder;
 
-public class ContainerTelePad extends ContainerEnder<IInventory> {
+import crazypants.enderio.machine.gui.IContainerWithTileEntity;
 
-    public ContainerTelePad(InventoryPlayer playerInv) {
+public class ContainerTelePad extends ContainerEnder<IInventory> implements IContainerWithTileEntity {
+
+    private final TileTelePad te;
+
+    public ContainerTelePad(InventoryPlayer playerInv, TileTelePad te) {
         super(playerInv, playerInv);
+        this.te = te;
     }
 
     @Override
@@ -19,4 +25,9 @@ public class ContainerTelePad extends ContainerEnder<IInventory> {
         p.translate(0, 34);
         return p;
     }
+
+    @Override
+    public TileEntity getTileEntity() {
+        return te;
+    }
 }

src/main/java/crazypants/enderio/teleport/telepad/GuiTelePad.java

@@ -51,7 +51,7 @@ public class GuiTelePad extends GuiContainerBaseEIO implements IToggleableGui {
     public static int SWITCH_X = 155, SWITCH_Y = 5;
 
     public GuiTelePad(InventoryPlayer playerInv, TileTelePad te, World world) {
-        super(new ContainerTelePad(playerInv), "telePad");
+        super(new ContainerTelePad(playerInv, te), "telePad");
         this.world = world;
         this.te = te;
         ySize += 34;

src/main/java/crazypants/enderio/teleport/telepad/PacketTeleport.java

@@ -1,7 +1,6 @@
 package crazypants.enderio.teleport.telepad;
 
 import net.minecraft.entity.Entity;
-import net.minecraft.tileentity.TileEntity;
 import net.minecraft.world.World;
 
 import com.enderio.core.common.network.MessageTileEntity;
@@ -10,6 +9,7 @@ import cpw.mods.fml.common.network.simpleimpl.IMessage;
 import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
 import crazypants.enderio.EnderIO;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketTeleport extends MessageTileEntity<TileTelePad>
@@ -60,20 +60,19 @@ public class PacketTeleport extends MessageTileEntity<TileTelePad>
     @Override
     public IMessage onMessage(PacketTeleport message, MessageContext ctx) {
         World world = ctx.side.isClient() ? EnderIO.proxy.getClientWorld() : message.getWorld(ctx);
-        TileEntity te = message.getTileEntity(world);
-        if (te instanceof TileTelePad) {
-            Entity e = world.getEntityByID(message.entityId);
-            switch (message.type) {
-                case BEGIN:
-                    ((TileTelePad) te).enqueueTeleport(e, false);
-                    break;
-                case END:
-                    ((TileTelePad) te).dequeueTeleport(e, false);
-                    break;
-                case TELEPORT:
-                    ((TileTelePad) te).wasBlocked = message.wasBlocked;
-                    break;
-            }
+        TileTelePad te = message.getTileEntity(world);
+        if (PacketUtil.isInvalidPacketForGui(ctx, te, getClass())) return null;
+        Entity e = world.getEntityByID(message.entityId);
+        switch (message.type) {
+            case BEGIN:
+                te.enqueueTeleport(e, false);
+                break;
+            case END:
+                te.dequeueTeleport(e, false);
+                break;
+            case TELEPORT:
+                te.wasBlocked = message.wasBlocked;
+                break;
         }
         return null;
     }

src/main/java/crazypants/enderio/xp/PacketDrainPlayerXP.java

@@ -10,6 +10,7 @@ import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
 import cpw.mods.fml.relauncher.Side;
 import crazypants.enderio.network.PacketHandler;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketDrainPlayerXP extends MessageTileEntity<TileEntity>
@@ -57,6 +58,7 @@ public class PacketDrainPlayerXP extends MessageTileEntity<TileEntity>
     public IMessage onMessage(PacketDrainPlayerXP message, MessageContext ctx) {
         EntityPlayer player = ctx.getServerHandler().playerEntity;
         TileEntity tile = message.getTileEntity(player.worldObj);
+        if (PacketUtil.isInvalidPacketForGui(ctx, tile, getClass())) return null;
         if (tile instanceof IHaveExperience) {
             IHaveExperience xpTile = (IHaveExperience) tile;
             if (player.capabilities.isCreativeMode && message.isContainerLevel) {

src/main/java/crazypants/enderio/xp/PacketGivePlayerXP.java

@@ -10,6 +10,7 @@ import cpw.mods.fml.common.network.simpleimpl.IMessageHandler;
 import cpw.mods.fml.common.network.simpleimpl.MessageContext;
 import cpw.mods.fml.relauncher.Side;
 import crazypants.enderio.network.PacketHandler;
+import crazypants.enderio.network.PacketUtil;
 import io.netty.buffer.ByteBuf;
 
 public class PacketGivePlayerXP extends MessageTileEntity<TileEntity>
@@ -53,6 +54,7 @@ public class PacketGivePlayerXP extends MessageTileEntity<TileEntity>
     public IMessage onMessage(PacketGivePlayerXP message, MessageContext ctx) {
         EntityPlayer player = ctx.getServerHandler().playerEntity;
         TileEntity tile = message.getTileEntity(player.worldObj);
+        if (PacketUtil.isInvalidPacketForGui(ctx, tile, getClass())) return null;
         if (tile instanceof IHaveExperience) {
             IHaveExperience xpTile = (IHaveExperience) tile;
             xpTile.getContainer().givePlayerXp(player, message.levels);