Todo: Add allowThirdpartyReader config variable.

plugins/Todo/config.py

@@ -46,5 +46,8 @@ Todo = conf.registerPlugin('Todo')
 # conf.registerGlobalValue(Todo, 'someConfigVariableName',
 #     registry.Boolean(False, _("""Help for someConfigVariableName.""")))
 
+conf.registerGlobalValue(Todo, 'allowThirdpartyReader',
+    registry.Boolean(False, _("""Determines whether users can read the
+    todo-list of another user.""")))
 
 # vim:set shiftwidth=4 softtabstop=4 expandtab textwidth=79:

plugins/Todo/plugin.py

@@ -142,6 +142,9 @@ class Todo(callbacks.Plugin):
             u = ircdb.users.getUser(msg.prefix)
         except KeyError:
             u = None
+        if u != user and not self.registryValue('allowThirdpartyReader'):
+            irc.error(_('You are not allowed to see other users todo-list.'))
+            return
         # List the active tasks for the given user
         if not taskid:
             try:

plugins/Todo/test.py

@@ -30,7 +30,7 @@
 from supybot.test import *
 
 class TodoTestCase(PluginTestCase):
-    plugins = ('Todo', 'User')
+    plugins = ('Todo', 'User', 'Config')
     _user1 = 'foo!bar@baz'
     _user2 = 'bar!foo@baz'
     def setUp(self):
@@ -66,6 +66,17 @@ class TodoTestCase(PluginTestCase):
         self.assertNotError('todo setpriority 1 100')
         self.assertNotError('todo setpriority 2 10')
         self.assertRegexp('todo', '#2: moo and #1: wash my car')
+        # Check permissions
+        self.prefix = self._user2
+        self.assertError('todo tester')
+        self.assertNotRegexp('todo tester', 'task id')
+        self.prefix = self._user1
+        self.assertNotError('todo tester')
+        self.assertNotError('config plugins.Todo.allowThirdpartyReader True')
+        self.prefix = self._user2
+        self.assertNotError('todo tester')
+        self.prefix = self._user1
+        self.assertNotError('todo tester')
 
     def testAddtodo(self):
         self.assertNotError('todo add code a new plugin')