[Security] /jobs skipquest lets any player replace other players' quests and drain their balance (missing authorization check)

[Kisekis]

Description of Issue

Description of Issue

/jobs skipquest [jobname] [questname] (playerName) allows any player (the permission jobs.command.skipquest is default: true in plugin.yml) to target any
other online player and:

1. Force-replace the victim's current daily quest (progress and rewards are lost, and the victim gets a /jobs quests popup).
2. If DailyQuests.SkipQuestCost > 0, withdraw that amount from the victim's balance — the attacker pays nothing.

There is no authorization check for the playerName argument: the code in src/main/java/com/gamingmesh/jobs/commands/list/skipquest.java resolves the
target via Jobs.getPlayerManager().getJobsPlayer(name) and never verifies sender == target or requires jobs.command.admin.. For comparison, sibling
commands (stats, points, log) all require jobs.command.admin. when operating on another player; skipquest is the only one missing it.

Steps to reproduce (offline-mode Paper 1.21.11, Jobs 5.2.6.6, Vault + economy):

1. alice joins the Miner job and receives a daily quest (e.g. DarkOne 0/150).

2. bob, a completely normal player with only default permissions, runs:
   /jobs skipquest Miner DarkTwo alice

3. Result:

   • alice's quest is replaced (DarkOne 0/150 -> DarkTwo 0/10), progress reset;
   • alice's balance drops from 1000 to 500 (SkipQuestCost = 500), bob's balance is untouched.

Relevant log excerpt (server-side, custom Vault economy provider):

[22:43:24 INFO]: balance alice = 1000.0
[22:43:27 INFO]: bob issued server command: /jobs skipquest Miner DarkTwo alice
[22:43:52 INFO]: bob issued server command: /jobs skipquest Miner DarkOne alice
[22:43:57 INFO]: balance alice = 500.0

Attacker's chat after the successful run: You skipped the quest and paid: 500.00 (deducted from alice).

Why a permission plugin cannot mitigate this (tested with LuckPerms 5.5.0):

• Default LuckPerms config (apply-bukkit-default-permissions: true) still grants the default: true Bukkit permission to everyone -> exploit works.

• Setting apply-bukkit-default-permissions: false blocks it, but then normal players lose the whole jobs feature (/jobs join etc. stop working) — i.e.
  "disable the feature", not a real fix.

• A server that wants to enable "players pay to skip their own quest" must grant jobs.command.skipquest — and that single permission also allows targeting
  anyone. Granting it re-opens the flaw.

Suggested fix: when the resolved target is not the sender, require jobs.command.admin.skipquest (mirror the pattern used by stats/points/log).

Version Information

Jobs: 5.2.6.6 DB: SQLite
CMILib: 1.5.9.9
Server: Paper(132) v1_21_R7 - 1.21.11 - paper 1.21.11-132 (MC: 1.21.11)
Economy: TestEconomy Vault: 1.7.3-b131

Errors: No errors/stacktraces. See the log excerpt in the description.

Relevant Config Sections

plugins/Jobs/generalConfig.yml

DailyQuests:
Enabled: true
ResetTime:
Hour: 4
Minute: 0
Skips: 1
SkipQuestCost: 500.0

plugin.yml (Jobs)

jobs.command.skipquest:
description: Grants access to the skipquest command
default: true

Relevant Plugins: Jobs Reborn 5.2.6.6 · CMILib 1.5.9.9 · Vault 1.7.3-b131 (provider: custom TestEconomy for the PoC) · LuckPerms 5.5.0 · Paper 1.21.11-132

Version Information

Jobs Reborn 5.2.6.6

Errors

Relevant Config Sections

Relevant Plugins

No response

[Momshroom]

I can replicate this on Jobs 5.2.6.5,CMILib 1.5.9.9, paper 26.1.2 #72,iConomy Unlocked, Vault 2.20.0