GitHub/PyLink
3
0
Fork 0
mirror of https://github.com/jlu5/PyLink.git synced 2024-11-23 19:19:31 +01:00
Code Issues Projects Releases Wiki Activity

relay: check permissions before clientbot op status to prevent arbitrary join triggering

Browse Source 
This mirrors the fix in 1.x: commit 141e941fcd
This commit is contained in:
James Lu 2018-06-07 13:38:01 -07:00
parent fee64ece04
commit b202954be4
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
plugins/relay.py
View File

@ -2243,6 +2243,7 @@ def link(irc, source, args):
If the --force option is given, this command will bypass checks for TS and whether the target
network is alive, and link the channel anyways."""
args = link_parser.parse_args(args)
# Normalize channel case
@ -2259,6 +2260,8 @@ def link(irc, source, args):
irc.error('Cannot link two channels on the same network.')
return
permissions.check_permissions(irc, source, ['relay.link'])
if localchan not in irc.channels or source not in irc.channels[localchan].users:
# Caller is not in the requested channel.
log.debug('(%s) Source not in channel %s; protoname=%s', irc.name, localchan, irc.protoname)
@ -2280,8 +2283,6 @@ def link(irc, source, args):
irc.error('You must be opped in %r to complete this operation.' % localchan)
return
permissions.check_permissions(irc, source, ['relay.link'])
if remotenet not in world.networkobjects:
irc.error('No network named %r exists.' % remotenet)
return