-#checks if a username begins by a letter and contains only letters, digits, -, _ or .
+#Checks if $username begins by a letter and contains only letters, digits, -, _ or .
proc tc2:username_isvalid {username} {
regexp {^[A-Za-z][A-Za-z0-9_\-\.]*$} $username
}
+#Determines if $username exists on the system
+#SECURITY: to avoid shell injection, call first tc2:username_isvalid $username
proc tc2:username_exists {username} {
- #TODO: Windows and other OSes
+ #TODO: Windows and other OSes (this line has been tested under FreeBSD)
if {[exec -- logins -oxl $username] == ""} {
return 0
} {
return 1
}
}
+#Gets server hostname
proc tc2:hostname {} {
exec hostname -s
}
+#Determines if $username is root
+proc tc2:isroot {username} {
+ #Validates input data
+ set username [string tolower $username]
+ if ![tc2:username_isvalid $username] {
+ return 0
+ }
+
+ #Check 1 - User has local accreditation
+ if ![sql "SELECT count(*) FROM tc2_roots WHERE account_username = '$username' AND server_name = '[sqlescape [tc2:hostname]]'"] {
+ return 0
+ }
+
+ #Check 2 - User is in the group wheel on the server
+ if {[lsearch [exec -- id -Gn $username] wheel] == "-1"} {
+ return 0
+ } {
+ return 1
+ }
+}
+
+#Determines if $requester is *EXPLICITELY* allowed to allowed to manage the account $user
+#When you invoke this proc, you should also check if the user is root.
+# e.g. if {[tc2:isroot $requester] || [tc2:userallow $requester $user]} { ... }
+proc tc2:userallow {requester user} {
+ set sql "SELECT count(*) FROM tc2_users_permissions WHERE server_name = '[sqlescape [tc2:hostname]]' AND account_username = '[sqlescape $user]' AND user_id = [getuserid $user]"
+ putdebug $sql
+ sql $sql
+}
+
+#tc2:getpermissions on $username: Gets permissions on the $username account
+#tc2:getpermissions from $username: Gets permissions $username have on server accounts
+proc tc2:getpermissions {keyword username} {
+ switch $keyword {
+ "from" {
+ set sql "SELECT account_username FROM tc2_users_permissions WHERE server_name = '[sqlescape [tc2:hostname]]' AND user_id = '[getuserid $username]'"
+ }
+ "on" {
+ set sql "SELECT u.username FROM tc2_users_permissions p, users u WHERE p.server_name = '[sqlescape [tc2:hostname]]' AND p.account_username = '$username' AND u.user_id = p.user_id"
+ }
+ default {
+ error "from or on expected"
+ }
+ }
+ set accounts ""
+ foreach row [sql $sql] {
+ lappend accounts [lindex $row 0]
+ }
+
+}
+
+#account permission
+#account isroot
+#account exists
+proc tc2:command:account {requester arg} {
+ set command [lindex $arg 0]
+ switch -- $command {
+ "exists" {
+ set username [lindex $arg 1]
+ if ![tc2:username_isvalid $username] {
+ return {0 "this is not a valid username"}
+ }
+ if [tc2:username_exists $username] {
+ list 1 "$username is a valid account on [tc2:hostname]."
+ } {
+ list 1 "$username isn't a valid account on [tc2:hostname]."
+ }
+ }
+
+ "isroot" {
+ set username [lindex $arg 1]
+ if ![tc2:username_isvalid $username] {
+ return {0 "this is not a valid username"}
+ }
+ if [tc2:isroot $username] {
+ list 1 "$username has got root accreditation on [tc2:hostname]."
+ } {
+ list 1 "$username doesn't seem to have any root accreditation [tc2:hostname]."
+ }
+ }
+
+ "permission" {
+ set username [lindex $arg 1]
+ if ![tc2:username_isvalid $username] {
+ return {0 "this is not a valid username"}
+ }
+
+ switch -- [lindex $arg 2] {
+ "" {
+ set sentences {}
+ set accounts_from [tc2:getpermissions from $username]
+ set accounts_on [tc2:getpermissions on $username]
+ if {$accounts_on != ""} {
+ lappend sentences "has authority upon [join $accounts_on ", "]"
+ }
+ if {$accounts_from != ""} {
+ lappend sentences "account can be managed from IRC by [join $accounts_from ", "]"
+ return "1 {$mandataire has now access to $username account.}"
+ }
+
+ "del" {
+ #e.g. .account permission espacewin del dereckson
+ # will remove access to the espacewin account to dereckson
+ if {![tc2:isroot $requester] && ![tc2:userallow $requester $username]} {
+ return "0 {you don't have the authority to manage the $username account.}"
+ }
+
+ #Asserts mandataire is a valid bot account
+ set mandataire [lindex $arg 3]
+ if {[set mandataire_user_id [getuserid $mandataire]] == ""} {
+ return "0 {$mandataire doesn't have a bot account, and so, no such permission.}"
+ }
+
+ #Checks if the permission exists
+ if ![tc2:userallow $requester $mandataire] {
+ return "0 {$mandataire haven't had an access to $username account.}"
+ }
+
+ #Removess the permission
+ sql "DELETE FROM tc2_users_permissions WHERE server_name = '[sqlescape [tc2:hostname]]' AND account_username = '$username' AND user_id = '$mandataire_user_id'"
+
+ return "1 {$mandataire doesn't have access to $username account anymore.}"
+ }
+
+ "+root" {
+ #Checks right and need
+ if ![tc2:isroot $requester] {
+ return "0 {you don't have root authority yourself.}"
+ }
+ if [tc2:isroot $username] {
+ return "0 {$username have already root authority.}"