Mikaela/Limnoria
1
0
Fork 0
mirror of https://github.com/Mikaela/Limnoria.git synced 2024-11-23 11:09:23 +01:00
Code Issues Projects Releases Wiki Activity

Channelstats: require caller to be in target channel when using commands in this plugin.

Browse Source 
This fixes information leakage from private channels.
This commit is contained in:
Daniel Folkinshteyn 2012-02-25 12:35:55 -05:00 committed by Valentin Lorentz
parent 2c051bab9f
commit e557541de1
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
plugins/ChannelStats/plugin.py
View File

@ -249,6 +249,9 @@ class ChannelStats(callbacks.Plugin):
necessary if the message isn't sent on the channel itself. If <name>
isn't given, it defaults to the user sending the command.
"""
if msg.nick not in irc.state.channels[channel].users:
irc.error(format('You must be in %s to use this command.', channel))
return
if name and ircutils.strEqual(name, irc.nick):
id = 0
elif not name:
@ -310,6 +313,9 @@ class ChannelStats(callbacks.Plugin):
'kicks', 'kicked', 'topics', and 'modes'. Any simple mathematical
expression involving those variables is permitted.
"""
if msg.nick not in irc.state.channels[channel].users:
irc.error(format('You must be in %s to use this command.', channel))
return
# XXX I could do this the right way, and abstract out a safe eval,
# or I could just copy/paste from the Math plugin.
if self._calc_match_forbidden_chars.match(expr):
@ -352,6 +358,9 @@ class ChannelStats(callbacks.Plugin):
Returns the statistics for <channel>. <channel> is only necessary if
the message isn't sent on the channel itself.
"""
if msg.nick not in irc.state.channels[channel].users:
irc.error(format('You must be in %s to use this command.', channel))
return
try:
stats = self.db.getChannelStats(channel)
curUsers = len(irc.state.channels[channel].users)