diff --git a/api/src/lib.rs b/api/src/lib.rs index d4b312b..ca1482f 100644 --- a/api/src/lib.rs +++ b/api/src/lib.rs @@ -2056,13 +2056,13 @@ pub trait Store { fn news_del(&mut self, id: u64) -> bool; fn news(&self, kind: NewsKind) -> Vec; // Abuse reports (ReportServ). `report_file` is rate-limited (None = too soon). - fn report_file(&mut self, reporter: &str, target: &str, reason: &str) -> Option; + fn report_file(&mut self, reporter: &str, cooldown_key: &str, target: &str, reason: &str) -> Option; fn report_close(&mut self, id: u64) -> bool; fn report_del(&mut self, id: u64) -> bool; fn reports(&self, open_only: bool) -> Vec; fn report(&self, id: u64) -> Option; // Help-desk tickets (HelpServ). `help_request` is rate-limited (None = too soon). - fn help_request(&mut self, requester: &str, message: &str) -> Option; + fn help_request(&mut self, requester: &str, cooldown_key: &str, message: &str) -> Option; fn help_take(&mut self, id: u64, handler: &str) -> bool; fn help_close(&mut self, id: u64) -> bool; fn help_tickets(&self, open_only: bool) -> Vec; diff --git a/modules/helpserv/src/lib.rs b/modules/helpserv/src/lib.rs index f61b020..d7bcb3c 100644 --- a/modules/helpserv/src/lib.rs +++ b/modules/helpserv/src/lib.rs @@ -60,7 +60,7 @@ impl Service for HelpServ { fn on_command(&mut self, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store) { let me = self.uid.as_str(); match args.first().map(|s| s.to_ascii_uppercase()).as_deref() { - Some("REQUEST") | Some("HELPME") => request::handle(me, from, &args[1..], ctx, db), + Some("REQUEST") | Some("HELPME") => request::handle(me, from, &args[1..], ctx, net, db), Some("CANCEL") => cancel::handle(me, from, ctx, db), Some("LIST") => list::handle(me, from, args.get(1).copied(), ctx, db), Some("VIEW") | Some("READ") => view::handle(me, from, args.get(1).copied(), ctx, db), diff --git a/modules/helpserv/src/request.rs b/modules/helpserv/src/request.rs index 27cb46e..58fe8f0 100644 --- a/modules/helpserv/src/request.rs +++ b/modules/helpserv/src/request.rs @@ -1,19 +1,16 @@ -use echo_api::{Sender, ServiceCtx, Store}; +use echo_api::{NetView, Sender, ServiceCtx, Store}; // REQUEST (aka HELPME): open a help-desk ticket for the staff. -pub fn handle(me: &str, from: &Sender, rest: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) { +pub fn handle(me: &str, from: &Sender, rest: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store) { let message = rest.join(" "); if message.trim().is_empty() { ctx.notice(me, from.uid, "Tell us what you need help with: REQUEST "); return; } - // Require identification, so the cooldown keys on a stable account rather than a - // spoofable nick a flooder can cycle to reset it. - let Some(requester) = from.account else { - ctx.notice(me, from.uid, "Please identify to NickServ before opening a ticket."); - return; - }; - match db.help_request(requester, &message) { + let requester = from.account.unwrap_or(from.nick); + // Rate-limit on the real host, not the spoofable nick (see REPORT). + let cooldown_key = net.host_of(from.uid).unwrap_or(from.uid); + match db.help_request(requester, cooldown_key, &message) { Some(id) => ctx.notice(me, from.uid, format!("Thanks — your request (\x02#{id}\x02) is in the queue. A staff member will be with you.")), None => ctx.notice(me, from.uid, "You just opened a ticket — please wait a moment before opening another."), } diff --git a/modules/reportserv/src/lib.rs b/modules/reportserv/src/lib.rs index 767a0d5..b0bbeee 100644 --- a/modules/reportserv/src/lib.rs +++ b/modules/reportserv/src/lib.rs @@ -50,10 +50,10 @@ impl Service for ReportServ { (BLURB, TOPICS) } - fn on_command(&mut self, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, _net: &dyn NetView, db: &mut dyn Store) { + fn on_command(&mut self, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store) { let me = self.uid.as_str(); match args.first().map(|s| s.to_ascii_uppercase()).as_deref() { - Some("REPORT") => report::handle(me, from, &args[1..], ctx, db), + Some("REPORT") => report::handle(me, from, &args[1..], ctx, net, db), Some("LIST") => list::handle(me, from, args.get(1).copied(), ctx, db), Some("VIEW") | Some("READ") => view::handle(me, from, args.get(1).copied(), ctx, db), Some("CLOSE") | Some("RESOLVE") => close::handle(me, from, args.get(1).copied(), ctx, db), diff --git a/modules/reportserv/src/report.rs b/modules/reportserv/src/report.rs index e87d8f2..a2c505f 100644 --- a/modules/reportserv/src/report.rs +++ b/modules/reportserv/src/report.rs @@ -1,7 +1,7 @@ -use echo_api::{Sender, ServiceCtx, Store}; +use echo_api::{NetView, Sender, ServiceCtx, Store}; // REPORT : file an abuse report. Rate-limited. -pub fn handle(me: &str, from: &Sender, rest: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) { +pub fn handle(me: &str, from: &Sender, rest: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store) { let Some((&target, reason_words)) = rest.split_first() else { ctx.notice(me, from.uid, "Syntax: REPORT "); return; @@ -11,13 +11,11 @@ pub fn handle(me: &str, from: &Sender, rest: &[&str], ctx: &mut ServiceCtx, db: return; } let reason = reason_words.join(" "); - // Require identification, so the cooldown keys on a stable account rather than a - // spoofable nick a flooder can cycle to reset it. - let Some(reporter) = from.account else { - ctx.notice(me, from.uid, "Please identify to NickServ before filing a report."); - return; - }; - match db.report_file(reporter, target, &reason) { + let reporter = from.account.unwrap_or(from.nick); + // Rate-limit on the real host, not the (spoofable) nick a flooder could cycle to + // reset the cooldown. Anonymous reports still work; the host anchors the limit. + let cooldown_key = net.host_of(from.uid).unwrap_or(from.uid); + match db.report_file(reporter, cooldown_key, target, &reason) { Some(id) => ctx.notice(me, from.uid, format!("Thanks — your report (\x02#{id}\x02) about \x02{target}\x02 has been sent to the staff.")), None => ctx.notice(me, from.uid, "You just filed a report — please wait a moment before filing another."), } diff --git a/src/engine/db/network.rs b/src/engine/db/network.rs index 41a4398..96b252f 100644 --- a/src/engine/db/network.rs +++ b/src/engine/db/network.rs @@ -460,10 +460,10 @@ impl Db { /// File an abuse report, rate-limited per reporter. Returns the new report's /// id, or None if the reporter filed one too recently. - pub fn report_file(&mut self, reporter: &str, target: &str, reason: &str) -> Option { + pub fn report_file(&mut self, reporter: &str, cooldown_key: &str, target: &str, reason: &str) -> Option { const COOLDOWN: u64 = 30; let now = now(); - let key = reporter.to_ascii_lowercase(); + let key = cooldown_key.to_ascii_lowercase(); if self.report_times.get(&key).is_some_and(|&t| now.saturating_sub(t) < COOLDOWN) { return None; } @@ -516,10 +516,10 @@ impl Db { /// Open a help-desk ticket, rate-limited per requester (shares the report /// throttle namespace). Returns the new ticket's id, or None if too soon. - pub fn help_request(&mut self, requester: &str, message: &str) -> Option { + pub fn help_request(&mut self, requester: &str, cooldown_key: &str, message: &str) -> Option { const COOLDOWN: u64 = 30; let now = now(); - let tkey = format!("help:{}", requester.to_ascii_lowercase()); + let tkey = format!("help:{}", cooldown_key.to_ascii_lowercase()); if self.report_times.get(&tkey).is_some_and(|&t| now.saturating_sub(t) < COOLDOWN) { return None; } diff --git a/src/engine/db/store.rs b/src/engine/db/store.rs index 7d07803..e57233c 100644 --- a/src/engine/db/store.rs +++ b/src/engine/db/store.rs @@ -344,8 +344,8 @@ impl Store for Db { fn news(&self, kind: NewsKind) -> Vec { Db::news(self, kind) } - fn report_file(&mut self, reporter: &str, target: &str, reason: &str) -> Option { - Db::report_file(self, reporter, target, reason) + fn report_file(&mut self, reporter: &str, cooldown_key: &str, target: &str, reason: &str) -> Option { + Db::report_file(self, reporter, cooldown_key, target, reason) } fn report_close(&mut self, id: u64) -> bool { Db::report_close(self, id) @@ -359,8 +359,8 @@ impl Store for Db { fn report(&self, id: u64) -> Option { Db::report(self, id) } - fn help_request(&mut self, requester: &str, message: &str) -> Option { - Db::help_request(self, requester, message) + fn help_request(&mut self, requester: &str, cooldown_key: &str, message: &str) -> Option { + Db::help_request(self, requester, cooldown_key, message) } fn help_take(&mut self, id: u64, handler: &str) -> bool { Db::help_take(self, id, handler) diff --git a/src/engine/kicker.rs b/src/engine/kicker.rs index 4e09f2e..e81648c 100644 --- a/src/engine/kicker.rs +++ b/src/engine/kicker.rs @@ -218,7 +218,7 @@ impl Engine { let threshold = self.db.channel(channel).map(|c| c.kickers.votekick).unwrap_or(0); let botnick = self.db.channel(channel).and_then(|c| c.assigned_bot.clone()); let (Some(botnick), true) = (botnick, threshold > 0) else { return None }; - let Some(botuid) = self.network.uid_by_nick(&botnick).map(str::to_string) else { return None }; + let botuid = self.network.uid_by_nick(&botnick).map(str::to_string)?; let Some(target_uid) = self.network.uid_by_nick(target_nick).map(str::to_string) else { return Some(vec![NetAction::Privmsg { from: botuid, to: channel.to_string(), text: format!("There's no \x02{target_nick}\x02 here to vote on.") }]); };