Mikaela/Limnoria
1
0
Fork 0
mirror of https://github.com/Mikaela/Limnoria.git synced 2024-11-14 22:49:23 +01:00
Code Issues Projects Releases Wiki Activity

Misc.last: Prevent potential information leaks

Browse Source 
Add required predicates which
1) Do not retrieve messages from a channel the calling user isn't in
2) Do not retrieve messages from a +s channel unless the calling user is in a
   query or in that channel

Signed-off-by: James Vega <jamessan@users.sourceforge.net>
This commit is contained in:
James Vega 2009-03-08 01:09:25 -05:00
parent 856f372303
commit f539e65b8e
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
plugins/Misc/plugin.py
View File

@ -1,5 +1,6 @@
### ###
# Copyright (c) 2002-2005, Jeremiah Fincher # Copyright (c) 2002-2005, Jeremiah Fincher
# Copyright (c) 2009, James Vega
# All rights reserved. # All rights reserved.
# #
# Redistribution and use in source and binary forms, with or without # Redistribution and use in source and binary forms, with or without
@ -323,6 +324,19 @@ class Misc(callbacks.Plugin):
# the channel we've been instructed to look at. # the channel we've been instructed to look at.
iterable.next() iterable.next()
predicates = list(utils.iter.flatten(predicates.itervalues())) predicates = list(utils.iter.flatten(predicates.itervalues()))
# Make sure the user can't get messages from channels they aren't in
def userInChannel(m):
return m.args[0] in irc.state.channels \
and msg.nick in irc.state.channels[m.args[0]].users
predicates.append(userInChannel)
# Make sure the user can't get messages from a +s channel unless
# they're calling the command from that channel or from a query
def notSecretMsg(m):
return not irc.isChannel(msg.args[0]) \
or msg.args[0] == m.args[0] \
or (m.args[0] in irc.state.channels \
and 's' not in irc.state.channels[m.args[0]].modes)
predicates.append(notSecretMsg)
resp = [] resp = []
if irc.nested and not \ if irc.nested and not \
self.registryValue('last.nested.includeTimestamp'): self.registryValue('last.nested.includeTimestamp'):