!whereis can be misused by players on Survival / PvP servers

minetest-mods / irc

IRC Mod for Minetest

BSD 2-Clause "Simplified" License

43 stars 31 forks source link

!whereis can be misused by players on Survival / PvP servers #48

Open ClobberXD opened 5 years ago

ClobberXD commented 5 years ago

(Originally reported here: rubenwardy/capturetheflag#107)

I suggest restricting !whereis to chan OPs if possible.

Will work on implementing this if approved.

kaeza commented 5 years ago

I've been thinking about removing that command. I'll accept a PR.

ClobberXD commented 5 years ago

In my opinion, !whereis is still useful for server staff... Shall I try to restrict that command to chan OPs as mentioned in my previous comment?

kaeza commented 5 years ago

Sure.

sofar commented 5 years ago

definitely worth doing

ClobberXD commented 5 years ago

Figured out how to get it to work, but I'm facing a (minor?) issue:

irc.conn.channels[irc.config.channel] contains a table of users in the channel, called users.
Each user in the table is indexed by their nick (user.nick), and stores an access table, with boolean flags for user-mode +o and +v.
The issue here is that the user's access table users[user.nick].access is empty. Am I missing something? Do I have to invoke some sort of an update function before accessing the table?

kaeza commented 5 years ago

From https://github.com/JakobOvrum/LuaIRC/blob/master/doc/irc.luadoc :

Apart from nick , fields may be missing. To fill them in, enable user tracking

And

Turn user information tracking on or off. User tracking is enabled by default. param b Boolean whether or not to track user information. function irc:trackUsers(b)

Either that, or track modes yourself with the OnUserMode callback.

That's what I get from a quick look at the docs and code, but you should probably ask upstream.

ClobberXD commented 5 years ago

User tracking is enabled by default.

If tracking is set to true by default (and it really is enabled, I checked), then this most likely is an upstream bug.

I initially did plan on using OnUserMode callback. I'll see if that works...

ClobberXD commented 5 years ago

How about removing this command from irc altogether? Commands like these should ideally be a part of MT itself.

minetest/minetest#7677 :)

magnetar47 commented 1 year ago

I've abandoned this, and the aforementioned PR in MT has been rejected. Anyone else interested is welcome to take this up.