Require essentials.whois.location to view coordinates in /whois

Fixes the information disclosure half of EssentialsX#6626: /whois sent exact
player coordinates to anyone holding essentials.whois. A new
essentials.whois.location node now guards the location line, matching
the existing essentials.seen.location design. Console and non-player
senders are unaffected.

Author: zzzzzyc

Essentials/src/main/java/com/earth2me/essentials/commands/Commandwhois.java

@@ -39,7 +39,9 @@ public void run(final Server server, final CommandSource sender, final String co
         sender.sendTl("whoisHealth", user.getBase().getHealth());
         sender.sendTl("whoisHunger", user.getBase().getFoodLevel(), user.getBase().getSaturation());
         sender.sendTl("whoisExp", SetExpFix.getTotalExperience(user.getBase()), user.getBase().getLevel());
-        sender.sendTl("whoisLocation", user.getLocation().getWorld().getName(), user.getLocation().getBlockX(), user.getLocation().getBlockY(), user.getLocation().getBlockZ());
+        if (sender.isAuthorized("essentials.whois.location")) {
+            sender.sendTl("whoisLocation", user.getLocation().getWorld().getName(), user.getLocation().getBlockX(), user.getLocation().getBlockY(), user.getLocation().getBlockZ());
+        }
         final long playtimeMs = System.currentTimeMillis() - (user.getBase().getStatistic(PLAY_ONE_TICK) * 50L);
         sender.sendTl("whoisPlaytime", DateUtil.formatDateDiff(playtimeMs));
         if (!ess.getSettings().isEcoDisabled()) {

Essentials/src/main/resources/plugin.yml

@@ -1401,6 +1401,8 @@ permissions:
     description: Allows access to the /whois command
   essentials.whois.ip:
     description: Allows access to the /whois command with IP address
+  essentials.whois.location:
+    description: Allows access to the /whois command with location
   essentials.workbench:
     description: Allows access to the /workbench command
   essentials.anvil: