linuxdcpp-team team mailing list archive

[Fredrik Ullner <ullner@xxxxxxxxx>]

1) Set the limit to 7000 in this  patch. I tested with 8000 and above,
and DC++ hung when trying to open the view. But that is the same before
and after a patch (the patch doesn't deal with displayment anyway). It
took no noticable time difference adding 1k, 5k or 10k user commands.
Perhaps we should set the limit to e.g. 5k to have a buffer zone?

2) Removed settings and use hard coded behaviour. (Always replace user
commands.)

3) I could not test any difference in performance (didn't feel like it
anyway...)

4) Removed.

5) No, it's correct, see the patch for a more descriptive check.

6) I wasn't too sure about it, but after some more investigation, all I
can find is that FLAG_NOSAVE is only external. Though, I suppose if
someone in the future adds behaviour for the ability (for the user) to
create temporary user commands , then it not work as intended... Anyway,
using FLAG_NOSAVE now.

To test the patch, add the following to the HubFrame.cpp (for instance):
http://pastebin.com/H7GMtavt

** Patch added: "dcpp_ucsec.diff"
   https://bugs.launchpad.net/dcplusplus/+bug/1030613/+attachment/3920131/+files/dcpp_ucsec.diff

-- 
You received this bug notification because you are a member of
Dcplusplus-team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1030613

Title:
  Normal users can issue CMDs

Status in ADCH++:
  Fix Released
Status in DC++:
  In Progress

Bug description:
  Any client may send a CMD (only B-type tested) to the hub,
  distributing it to any user. If done in a bot, you can effectively
  send tens or hundreds of these, and a receiving client will be forced
  to manage them, thus potentially causing a DoS scenario.

  Generate the following user command in DC++ to test yourself;
  Command type: Raw
  Context: Hub menu
  Name: RogueCommand
  Command: BCMD %[mySID] Security\stest,\sbe\safraid TTHINF\sNIfoobar\n CT2
  Hub address: adc://

  (Above command should obviously be followed by a new line.)

  The hub should ignore any CMD originating from a user. Potentially
  allow CMDs from trusted users.

To manage notifications about this bug go to:
https://bugs.launchpad.net/adchpp/+bug/1030613/+subscriptions