When I op a player to level 2 on minecraft_server_1.8.6 it works just fine. The player is able to run command "/gamemode 2", but not command "/stop". This is correct. But on bukkit or spigot 1.8.6 the player is able to run commands "/stop" "/ban" "/kick" while he is on level 2 in ops.json. I have tested this thorougly now. Anyone experienced the same?
Yes, I am experiencing exactly this problem since I started using Spigot a few days ago. The vanilla op permission level system seems to be completely broken at the moment. Any op (even level 1) can run any command, including /stop. There also seems to be no plugin/game configuration file that contains a line giving '*' permissions to anyone.
I solved this problem by using the "Group Manager" plugin and no one being op at all. In the Group Manager settings I gave the default users the commands I wanted, i.e. permissions: - minecraft.command.gamemode
No, you said: "There may be an option in spigot.yml, if not there is an option in server.properties" Doesnt't matter. I have solved the issue.
