-
-
Notifications
You must be signed in to change notification settings - Fork 402
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
admin: add .raw command to send raw IRC messages #2104
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Simple and to the point. Only usable by owner in PM makes sense. The code review is not a sticking point here; I just wonder about privesc as @Exirel mentioned on IRC. For example, .raw MODE #channel +o EvilOwner
could bypass the very intentional usage restrictions on .op
from the adminchannel
plugin.
Of course anyone who gives a bot +o on a channel must implicitly trust the bot's owner not to overstep, so that's no reason for a hard rejection. EvilOwner could just as well write a very simple plugin to opportunistically take over channels where the bot has op, even without the .raw
command. But we should still think about this. It could be prudent to put in a separate plugin, for example, so it's easy to disable without losing the rest of admin
's functions.
The only way I can come up with that this could be abused is if the bot owner were impersonated and they wanted to do something that was not possible with an enabled builtin command. On one hand, we can't save everyone from everything - On the other hand, I suppose it is a relatively niche need, so maybe it does just belong in everyone's |
A suite of debug tools could be its own PyPI package, though. It would be disabled by default because the bot owner would need to install it. We're moving toward (almost) all plugins being packaged separately, anyway.
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Suffice it to say that, regardless of where we land on having a plugin for debug tools, whether core or external, this is good to go. Nothing is unchangeable.
Description
Adds a
.raw
command toadmin.py
to allow commanding the bot to send a raw IRC message, e.g..raw OPER Sopel ThisIsABadIdea123
Checklist
make qa
(runsmake quality
andmake test
)