Disallow retrieving other people's capabilities and make the response private so we don't leak channel information.

This commit is contained in:
James Vega 2005-02-19 00:23:34 +00:00
parent 21970da9f0
commit aff8f8636e

View File

@ -317,7 +317,16 @@ class User(callbacks.Plugin):
Returns the capabilities of the user specified by <name>; if <name>
isn't specified, returns the hostmasks of the user calling the command.
"""
irc.reply('[%s]' % '; '.join(user.capabilities))
try:
u = ircdb.users.getUser(msg.prefix)
except KeyError:
irc.errorNotRegistered()
else:
if u == user or u._checkCapability('owner'):
irc.reply('[%s]' % '; '.join(user.capabilities), private=True)
else:
irc.error(conf.supybot.replies.incorrectAuthentication(),
Raise=True)
capabilities = wrap(capabilities, [first('otherUser', 'user')])
def identify(self, irc, msg, args, user, password):