From 8bd37dbff700c53b2a42305530e58713f4a64c4f Mon Sep 17 00:00:00 2001 From: James Vega Date: Mon, 25 May 2009 00:30:13 -0400 Subject: [PATCH] Channel: Don't let nicks leak private info. Signed-off-by: James Vega --- plugins/Channel/plugin.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/plugins/Channel/plugin.py b/plugins/Channel/plugin.py index 02e7f81d7..088dd7bf7 100644 --- a/plugins/Channel/plugin.py +++ b/plugins/Channel/plugin.py @@ -766,10 +766,17 @@ class Channel(callbacks.Plugin): Returns the nicks in . is only necessary if the message isn't sent in the channel itself. """ + # Make sure we don't elicit information about private channels to + # people or channels that shouldn't know + if 's' in irc.state.channels[channel].modes and \ + msg.args[0] != channel and \ + (ircutils.isChannel(msg.args[0]) or \ + msg.nick not in irc.state.channels[channel].users): + irc.error('You don\'t have access to that information.') L = list(irc.state.channels[channel].users) utils.sortBy(str.lower, L) irc.reply(utils.str.commaAndify(L)) - nicks = wrap(nicks, ['inChannel']) # XXX Check that the caller is in chan. + nicks = wrap(nicks, ['inChannel']) def alertOps(self, irc, channel, s, frm=None): """Internal message for notifying all the #channel,ops in a channel of