From dea037008438baf1850befbed20a696cbe259af6 Mon Sep 17 00:00:00 2001
From: youpaishidifu <1@ypshidifu.cn>
Date: Thu, 8 Oct 2026 22:18:17 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8Demail=E6=9C=AA=E7=99=BB?=
 =?UTF-8?q?=E5=BD=95=E8=B6=8A=E6=9D=83=E6=BC=8F=E6=B4=9E=EF=BC=9A=E4=BB=8E?=
 =?UTF-8?q?=E6=9C=AA=E7=99=BB=E5=BD=95=E6=94=BE=E8=A1=8C=E5=90=8D=E5=8D=95?=
 =?UTF-8?q?=E7=A7=BB=E9=99=A4email/=E7=BB=91=E5=AE=9A/=E7=BB=91=E5=AE=9A?=
 =?UTF-8?q?=E9=82=AE=E7=AE=B1=EF=BC=8C=E4=B8=89=E4=B8=AA=E7=BB=91=E5=AE=9A?=
 =?UTF-8?q?=E5=85=A5=E5=8F=A3=E5=8A=A0=E7=99=BB=E5=BD=95=E7=A1=AC=E6=A0=A1?=
 =?UTF-8?q?=E9=AA=8C=EF=BC=8C=E7=89=88=E5=8F=B7=E5=88=87=E5=9B=9E3.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/main/java/Sdf1_login/Main.java | 17 ++++++++++++++++-
 src/main/resources/plugin.yml      |  2 +-
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/src/main/java/Sdf1_login/Main.java b/src/main/java/Sdf1_login/Main.java
index 7bc5443..83d30aa 100644
--- a/src/main/java/Sdf1_login/Main.java
+++ b/src/main/java/Sdf1_login/Main.java
@@ -3680,7 +3680,7 @@ public class Main extends JavaPlugin
     private static final Set<String> FROZEN_ALLOWED_CMDS = new HashSet<>(java.util.Arrays.asList(
             "l", "login", "reg", "sdf1_login",
             "注册", "登录", "改密码", "找回密码",
-            "mslogin", "正版", "email", "绑定", "绑定邮箱",
+            "mslogin", "正版",
             "删除账号", "通过", "拒绝", "web", "控制台",
             "2fa", "help"));
 
@@ -8645,6 +8645,11 @@ public class Main extends JavaPlugin
 
         // 绑定邮箱
         if (cmdName.equals("绑定邮箱")) {
+            // ★ 3.0 安全修复：邮箱绑定必须登录后才能执行（未登录越权绑邮箱 + 任意收件人 SMTP 滥发）
+            if (sender instanceof Player && isFrozen((Player) sender)) {
+                sender.sendMessage("§c§l[登录] §f你还未登录，无法使用该命令。请先使用 §e/l <密码> §f登录");
+                return true;
+            }
             if (!(sender instanceof Player)) {
                 sender.sendMessage("§c仅玩家可用");
                 return true;
@@ -8751,6 +8756,11 @@ public class Main extends JavaPlugin
 
         // ===== /email /绑定 独立命令 =====
         if (cmdName.equals("email") || cmdName.equals("绑定")) {
+            // ★ 3.0 安全修复：邮箱绑定必须登录后才能执行（未登录越权绑邮箱 + 任意收件人 SMTP 滥发）
+            if (sender instanceof Player && isFrozen((Player) sender)) {
+                sender.sendMessage("§c§l[登录] §f你还未登录，无法使用该命令。请先使用 §e/l <密码> §f登录");
+                return true;
+            }
             // /email reload —— 控制台/玩家均可执行
             if (args.length >= 1
                     && args[0].equalsIgnoreCase("reload")) {
@@ -9423,6 +9433,11 @@ public class Main extends JavaPlugin
 
 // ===== email =====
         if (sub.equals("email")) {
+            // ★ 3.0 安全修复：邮箱绑定必须登录后才能执行（未登录越权绑邮箱 + 任意收件人 SMTP 滥发）
+            if (sender instanceof Player && isFrozen((Player) sender)) {
+                sender.sendMessage("§c§l[登录] §f你还未登录，无法使用该命令。请先使用 §e/l <密码> §f登录");
+                return true;
+            }
             // email reload —— 控制台/玩家均可执行，仅需isAdmin
             if (args.length >= 2
                     && args[1].equalsIgnoreCase("reload")) {
diff --git a/src/main/resources/plugin.yml b/src/main/resources/plugin.yml
index 81d0cc6..3dd76db 100644
--- a/src/main/resources/plugin.yml
+++ b/src/main/resources/plugin.yml
@@ -1,5 +1,5 @@
 name: Sdf1_login
-version: 3.01
+version: 3.0
 main: Sdf1_login.Main
 api-version: '1.21'
 commands: