BadWhois by caesar - buggy Help

chandra Sha · Post by **chandra Sha** » Sat Dec 16, 2006 1:02 pm

## ¤ BadWhois
# version 0.1
# caesar <cezarica [at] prietenii [dot] com>
# #eggdrop @ Undernet.org
# http://www.r0x0ring.com/

###
## ¤ Description:
# Performs a whois on join and places a *!*@host ban if mathes a banned realname or a banned channel.

###
## ¤ Available commands:
#
#     Where  Flag Command   Description
#     -----  ---- -------   -----------
#     PUB : N/A
#
#     MSG : N/A
#
#     DCC :  n|n .chanset   Use .chanset to set what protections to active for the particular channel or not.
#                           Example: .chanset #mychan +badwhois
#                                    .chanset #otherchan -badwhois

###
## ¤ Custom channel flags:
#
#  Flag:       Description:
#  -----       ------------
#  +badwhois  Channels marked with this flag will be "checked" for bad realnames and bad channels on join.
#
# Attention!
#  By default the channel flag (badwhois) is disabled. Enable it on the channels you wish.
#  Don't use this script
#

##
# Adjust the folowing things to suit your needs!

# .1. What bad realnames should be banned?
set bwhois(list) {
"foo bar"
"bla bla"
"*moo*"
"???"
"*http://*"
"*www.*"
}

# .2. What bad channels should be banned?
set bwhois(chans) {#foo #moo #bar}

# .3. Specify the ban reason and the ban time (in minutes) for a bad realname:
set bwhois(br) {"You norteh norteh boy!" 60}

# .4. Specify the ban reason and the ban time (in minutes) for a bad channel:
set bwhois(bc) {"Wrong channel boy!" 60}

# .4. Number of joins in seconds do a delayed whois.
set bwhois(flud) "5:3:10"

#
## ¤ Don't edit past here unless you know TCL! ¤
#

set bwhois(version) "0.1"
setudef flag badwhois

##
# ¤ binds

bind join * * badwhois:join
bind part - * badwhois:part
bind raw - 311 badwhois:check
bind raw - 319 badwhois:chans

##
# ¤ whois on join

proc badwhois:join {nick uhost hand chan} { 
  global bflud bwhois
  if {![channel get $chan badwhois] || [isbotnick $nick ] || [matchattr $hand f|f $chan]} {
    return
  } 
  if {![info exists bflud($chan)]} {
    set bflud($chan) 0
  }
  incr bflud($chan)
  utimer [lindex [set bla [split $bwhois(flud) ":"]] 1] [list incr bflud($chan) -1]
  if {$bflud($chan) >= [lindex $bla 0]} {
    puthelp "WHOIS $nick"
    } else {
    utimer [lindex $bla 2] [puthelp "WHOIS $nick"]
  }
  lappend bwhois(whois) "$nick:$chan:*!*@[lindex [split $uhost @] 1]"
}

##
# ¤ realname check

proc badwhois:check {from key txt} { 
  global bwhois
  if {![info exists bwhois(whois)]} {
    set bwhois(whois) ""
  }
  if {[isbotnick [set nick [lindex [split $txt] 1]]] || [validuser [nick2hand $nick]]} {
    return
  }
  set realname [stripcodes bcruag [string range [join [lrange [split $txt] 5 end]] 1 end]]
  foreach bla $bwhois(list) {
    if {[string match -nocase $bla $realname]} {
      set position [lsearch $bwhois(whois) "*:[set mask *!*@[lindex $txt 3]]*"]
      if {[botisop [set chan [lindex [set t [split [lindex $bwhois(whois) $position] :]] 1]]]} {
        putquick "KICK $chan $nick :[lindex $bwhois(br) 0]" -next
      }
      newchanban $chan $mask BadWhois [lindex $bwhois(br) 0] [lindex $bwhois(br) 1]
      set bwhois(whois) [lreplace $bwhois(whois) $position $position]
      break
    }
  }
}

##
# ¤ channels check

proc badwhois:chans {from key txt} { 
  global bwhois
  if {[isbotnick [set nick [lindex [split $txt] 1]]] || [validuser [nick2hand $nick]]} {
    return
  }
  if {[set position [lsearch $bwhois(whois) "*$nick:*"]] != -1} {
    foreach bla [lrange $txt 2 e] {
      if {[string match -nocase "*[string trimleft $bla ":@+"]*" $bwhois(chans)]} {
        if {[botisop [set chan [lindex [set t [split [lindex $bwhois(whois) $position] :]] 1]]]} {
          putquick "KICK $chan [lindex $t 0] :[lindex $bwhois(bc) 0]" -next
        }
        newchanban $chan [lindex $t 2] BadWhois [lindex $bwhois(bc) 0] [lindex $bwhois(bc) 1]
        set bwhois(whois) [lreplace $bwhois(whois) $position $position]
        break
      }
    }
  }
}

##
# ¤ array remove

proc badwhois:part {nick uhost hand chan msg} {
  global bflud
  if {[isbotnick $nick] && [string match -nocase "*$chan*" [array names bflud]]} {
    array unset bflud $chan
  }
}

putlog "badwhois v$bwhois(version) loaded.."

It's work Great, but not work with [nick...]
ex:
BOT on #chan1 have blacklist for #chan2
when nick on #chan2 join #chan1 he will get banned and kick
but when nick change nick to [nick] BOT not respon
and then when [nick] change nick to nick again BOT never respond anymore

Any can solve this? thx.

Post by **nml375** » Sat Dec 16, 2006 1:11 pm

I hav'nt looked through that script yet, but generally;
If a script starts behaving oddly or stop responding when you use a nick with [] in the name, unload that script instantly as there is a great chance the script has a remote code exploit within it (just try using the nick [die]).

I'd strongly suggest you stop using this script until anyone can confirm it does not suffer from such an exploit.

rosc2112 · Post by **rosc2112** » Sat Dec 16, 2006 4:27 pm

There are no [split] commands that would make the script tcl-special-char safe, so yeah, it's gonna choke on {} [] " \ and other such chars in names.

demond · Post by **demond** » Sun Dec 17, 2006 2:18 pm

rosc2112 wrote:There are no [split] commands that would make the script tcl-special-char safe, so yeah, it's gonna choke on {} [] " \ and other such chars in names.

[split] is a prerequisite for not choking on special chars

safety - or rather script security - is another matter which requires awareness of double evaluation

Post by **Sir_Fz** » Sun Dec 17, 2006 6:11 pm

Safety and security are 2 different things in software engineering as I've read and learned; safety is about the safety of the surrounding environment (harm) while security is about the software being able to protect itself from accidental or deliberate intrusion.

chandra Sha · Post by **chandra Sha** » Mon Dec 18, 2006 8:33 am

yeah, i will never use badwhois anymore, but if i still must using this script or if i found same buggy on another or any script (actualy i found same problem on Spam Detective v1.0 by MarlbMan), any have antidote for that?

Alchera · Post by **Alchera** » Mon Dec 18, 2006 9:16 am

chandra Sha: caesar will probably post a solution when he next logs on.

rosc2112 · Post by **rosc2112** » Mon Dec 18, 2006 4:03 pm

Presumably the bad-whois script from mc8 works, I use his badchannel script with no problems..

Post by **caesar** » Mon Dec 18, 2006 4:31 pm

Alchera wrote:chandra Sha: caesar will probably post a solution when he next logs on.

yes, remove it as it's obsolete. it should be removed from TCL Archive as well (if it's there). I no longer have nor the time nor the mood on continuing this... so I'll just hang around from time to time (as if someone would care, anyway).

demond · Post by **demond** » Tue Dec 19, 2006 1:44 am

caesar wrote:(as if someone would care, anyway).

I care! if you leave, there will be no oldtimers left anymore (except slennox that is) which would be sad

Post by **Sir_Fz** » Tue Dec 19, 2006 7:05 am

Yeah, I myself learned a lot from you caesar