Forbidden commands in ADC

[maksis]

When DC++ receives a STA message with code 25, it adds the command in to the list of forbidden outgoing commands. However, the client doesn't check that the STA message originates from the hub, so any other client could send malicious STA messages and prevent DC++ from sending any outgoing command via the hub. The fix is rather trivial.

I generally dislike the way how code 25 is handled, as DC++ doesn't notify the user when it blocks a command and neither when an outgoing command is disregarded right before sending.

[Francisco Blas Izquierdo Riera (klondike) (klondike)]

I can write a simple script to block these on ADCH++, has any of you managed to confirm this?

[maksis (maksis)]

As it seems that no one is unable to confirm this, I made an user command that will make all DC++ users unable to send main chat messages:
BSTA %[mySID] 225 Chatting\sdisabled FCBMSG

I also quickly looked at the other command handling code and that isn't the only command that isn't validated properly...

Disconnect all users by causing a decompression error:
BZON %[mySID] 123

Prompt all users for a password and prevent them from sending any outgoing commands after that (ADCH++ won't broadcast this but Flexhub and uhub will do that):
BGPA %[mySID] 123

Reset the session password from all users:
BSTA %[mySID] 223 Session\spass\sreset

[poy (poy)]

most commands the hub can avoid dispatching, except STA (it would have to peek into STA codes and do case-by-case handling) and ZON/ZOFF (extensions) for which i have applied (a slightly modified version of) this patch.

[Francisco Blas Izquierdo Riera (klondike) (klondike)]

Added ADCH++ and ADCH++ lan we should provide a way to filter those whilst the patches roll out.

[poy (poy)]

Fixed in DC++ 0.825.