fedserv/echo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Rate-limit REPORT and REQUEST on the real host instead of the spoofable nick

Browse source
This commit is contained in:
Jean Chevronnet 2026-07-19 13:39:03 +00:00
parent b2ffc01e52
commit 3648c48d2e
No known key found for this signature in database
8 changed files with 27 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

2
modules/helpserv/src/lib.rs
View file

@ -60,7 +60,7 @@ impl Service for HelpServ {
fn on_command(&mut self, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store) {
let me = self.uid.as_str();
match args.first().map(|s| s.to_ascii_uppercase()).as_deref() {
Some("REQUEST") | Some("HELPME") => request::handle(me, from, &args[1..], ctx, db),
Some("REQUEST") | Some("HELPME") => request::handle(me, from, &args[1..], ctx, net, db),
Some("CANCEL") => cancel::handle(me, from, ctx, db),
Some("LIST") => list::handle(me, from, args.get(1).copied(), ctx, db),
Some("VIEW") | Some("READ") => view::handle(me, from, args.get(1).copied(), ctx, db),

15
modules/helpserv/src/request.rs
View file

@ -1,19 +1,16 @@
use echo_api::{Sender, ServiceCtx, Store};
use echo_api::{NetView, Sender, ServiceCtx, Store};
// REQUEST <message> (aka HELPME): open a help-desk ticket for the staff.
pub fn handle(me: &str, from: &Sender, rest: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
pub fn handle(me: &str, from: &Sender, rest: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store) {
let message = rest.join(" ");
if message.trim().is_empty() {
ctx.notice(me, from.uid, "Tell us what you need help with: REQUEST <message>");
return;
}
// Require identification, so the cooldown keys on a stable account rather than a
// spoofable nick a flooder can cycle to reset it.
let Some(requester) = from.account else {
ctx.notice(me, from.uid, "Please identify to NickServ before opening a ticket.");
return;
};
match db.help_request(requester, &message) {
let requester = from.account.unwrap_or(from.nick);
// Rate-limit on the real host, not the spoofable nick (see REPORT).
let cooldown_key = net.host_of(from.uid).unwrap_or(from.uid);
match db.help_request(requester, cooldown_key, &message) {
Some(id) => ctx.notice(me, from.uid, format!("Thanks — your request (\x02#{id}\x02) is in the queue. A staff member will be with you.")),
None => ctx.notice(me, from.uid, "You just opened a ticket — please wait a moment before opening another."),
}

4
modules/reportserv/src/lib.rs
View file

@ -50,10 +50,10 @@ impl Service for ReportServ {
(BLURB, TOPICS)
}
fn on_command(&mut self, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, _net: &dyn NetView, db: &mut dyn Store) {
fn on_command(&mut self, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store) {
let me = self.uid.as_str();
match args.first().map(|s| s.to_ascii_uppercase()).as_deref() {
Some("REPORT") => report::handle(me, from, &args[1..], ctx, db),
Some("REPORT") => report::handle(me, from, &args[1..], ctx, net, db),
Some("LIST") => list::handle(me, from, args.get(1).copied(), ctx, db),
Some("VIEW") | Some("READ") => view::handle(me, from, args.get(1).copied(), ctx, db),
Some("CLOSE") | Some("RESOLVE") => close::handle(me, from, args.get(1).copied(), ctx, db),

16
modules/reportserv/src/report.rs
View file

@ -1,7 +1,7 @@
use echo_api::{Sender, ServiceCtx, Store};
use echo_api::{NetView, Sender, ServiceCtx, Store};
// REPORT <nick|#channel> <reason>: file an abuse report. Rate-limited.
pub fn handle(me: &str, from: &Sender, rest: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
pub fn handle(me: &str, from: &Sender, rest: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store) {
let Some((&target, reason_words)) = rest.split_first() else {
ctx.notice(me, from.uid, "Syntax: REPORT <nick|#channel> <reason>");
return;
@ -11,13 +11,11 @@ pub fn handle(me: &str, from: &Sender, rest: &[&str], ctx: &mut ServiceCtx, db:
return;
}
let reason = reason_words.join(" ");
// Require identification, so the cooldown keys on a stable account rather than a
// spoofable nick a flooder can cycle to reset it.
let Some(reporter) = from.account else {
ctx.notice(me, from.uid, "Please identify to NickServ before filing a report.");
return;
};
match db.report_file(reporter, target, &reason) {
let reporter = from.account.unwrap_or(from.nick);
// Rate-limit on the real host, not the (spoofable) nick a flooder could cycle to
// reset the cooldown. Anonymous reports still work; the host anchors the limit.
let cooldown_key = net.host_of(from.uid).unwrap_or(from.uid);
match db.report_file(reporter, cooldown_key, target, &reason) {
Some(id) => ctx.notice(me, from.uid, format!("Thanks — your report (\x02#{id}\x02) about \x02{target}\x02 has been sent to the staff.")),
None => ctx.notice(me, from.uid, "You just filed a report — please wait a moment before filing another."),
}