In-mod permission systems(top)
The world downloader mod implements a plugin channel-based permission system. This can be used to disable the mod (or switch it into a request only mode) as you desire.
(BROKEN) Anti-xray-based system(top)
Since Anti-Xray was removed from spigot in 1.9, this method is no longer functional. Alternative Anti-Xray plugins still can be used. A plugin that can do this is Orebfuscator.
Prerequisites(top)Spigot Anti-Xray running in engine mode 2
Theory(top)By using engine mode 2's obfuscation to our advantage, if a user loads up a downloaded world with this method, it will cause the world to explode or in the case of some lower end computers, freeze their game.
This is due to the client receiving redstone blocks (a constant redstone output) and TNT in places that do not touch air, but since they are not real, your server does not tick them. In the process of saving the map files locally, the user will also save these blocks but in their real form, and once the files are loaded, the blocks will be ticked and explode as expected.
This is not fool proof and has several methods to be bypassed, but it can do the job against the lower end of the spectrum.
This would work better for hubs, survival games, minigames, etc. Anything involving mining may produce noticeable "lag" to some players.
- Access your spigot.yml
- Enable the anti-xray
- Change engine mode to 2
- Add blocks 46 (TNT) and 152 (Redstone block) to hide-blocks
- Save config and reupload to server
- Restart server