Java Edition:Command Sign
In version 14w25a (1.8 snapshot), signs received JSON text support, including the ability to run commands through the clickEvent tag. The sign packet was only supposed to allow for raw text JSON components, but instead it allowed for any JSON component. This allowed for modified clients to create signs which could execute commands through the clickEvent tag. These commands would be executed with level 4 operator privileges, allowing any non-op player to execute any command. This is extremely dangerous, especially on multiplayer servers.
Signs were changed in 1.8.5 to only execute commands with level 2 operator privileges, but this still allows access to a very wide variety of commands. Keep in mind that command syntax changes over the versions, and as commands are not updated automatically, it would be wise to create command signs for older and newer syntax. For example, /gamemode used to allow numerical and single character abbreviations, such as /gamemode 1 Steve. This was changed in 1.13 to require the full gamemode to be specified, in the form of /gamemode creative Steve.
Obtaining
This feature requires a Modified Client to be created, but it will work on any vanilla server. The client must modify the sign GUI class to send a custom sign update packet containing the command(s) one wishes to place into the sign.
When a client needs to update the contents of a sign to the server, it does so by serializing an array containing four Text elements, one per line. The server will then deserialize this array, and copy it directly to the signs tile entity with zero checks on the input. Normally, when a client sends this data, this array only contains LiteralText elements without any styling applied to them. However, modified clients can apply custom styling to this data, such as ClickEvents.
ClickEvents have many variations, but the important one is the command click event, as when a sign is right clicked, it will iterate through its text elements and attempt to execute any command click events with either level 4 operator privileges or level 2 operator privileges, depending on the version.
| Command Sign Clients | |
|---|---|
| Mod | Versions |
| SignMod by Captain_S0L0 | 1.8 |
Using
Once the sign is created, it may simply be right-clicked by any player to execute the stored commands. The player does not need operator privileges, and cheats do not need to be enabled in the world.
If one is in versions 23w12a (1.20 Snapshot) to 23w13a_or_b, the sign must be waxed to be able to execute its commands, and attempting to edit the sign will result in the commands being removed. In 23w14a and above, signs with commands become uneditable by default and do not need to be waxed to be able to execute their commands.
Uses
Items which were added after 1.8 can be obtained by creating a chest with a BlockEntityTag.Items tag, this will allow the chest to hold items, even items which have not been added to the game yet. The player must wait until these are added to place the chest, if the chest is placed prior to the item being added it could be deleted. This can also be used for any block by creating a block item with a custom BlockEntityTag, and an entity by creating spawn eggs with a custom EntityTag.