git.r.bdr.sh - rbdr/mobius/blob - hotline/transaction_handlers.go

   1 package hotline
   2
   3 import (
   4         "bytes"
   5         "encoding/binary"
   6         "errors"
   7         "fmt"
   8         "gopkg.in/yaml.v3"
   9         "math/big"
  10         "os"
  11         "path"
  12         "path/filepath"
  13         "sort"
  14         "strings"
  15         "time"
  16 )
  17
  18 type HandlerFunc func(*ClientConn, *Transaction) ([]Transaction, error)
  19
  20 type TransactionType struct {
  21         Handler        HandlerFunc // function for handling the transaction type
  22         Name           string      // Name of transaction as it will appear in logging
  23         RequiredFields []requiredField
  24 }
  25
  26 var TransactionHandlers = map[uint16]TransactionType{
  27         // Server initiated
  28         TranChatMsg: {
  29                 Name: "TranChatMsg",
  30         },
  31         // Server initiated
  32         TranNotifyChangeUser: {
  33                 Name: "TranNotifyChangeUser",
  34         },
  35         TranError: {
  36                 Name: "TranError",
  37         },
  38         TranShowAgreement: {
  39                 Name: "TranShowAgreement",
  40         },
  41         TranUserAccess: {
  42                 Name: "TranUserAccess",
  43         },
  44         TranNotifyDeleteUser: {
  45                 Name: "TranNotifyDeleteUser",
  46         },
  47         TranAgreed: {
  48                 Name:    "TranAgreed",
  49                 Handler: HandleTranAgreed,
  50         },
  51         TranChatSend: {
  52                 Name:    "TranChatSend",
  53                 Handler: HandleChatSend,
  54                 RequiredFields: []requiredField{
  55                         {
  56                                 ID:     FieldData,
  57                                 minLen: 0,
  58                         },
  59                 },
  60         },
  61         TranDelNewsArt: {
  62                 Name:    "TranDelNewsArt",
  63                 Handler: HandleDelNewsArt,
  64         },
  65         TranDelNewsItem: {
  66                 Name:    "TranDelNewsItem",
  67                 Handler: HandleDelNewsItem,
  68         },
  69         TranDeleteFile: {
  70                 Name:    "TranDeleteFile",
  71                 Handler: HandleDeleteFile,
  72         },
  73         TranDeleteUser: {
  74                 Name:    "TranDeleteUser",
  75                 Handler: HandleDeleteUser,
  76         },
  77         TranDisconnectUser: {
  78                 Name:    "TranDisconnectUser",
  79                 Handler: HandleDisconnectUser,
  80         },
  81         TranDownloadFile: {
  82                 Name:    "TranDownloadFile",
  83                 Handler: HandleDownloadFile,
  84         },
  85         TranDownloadFldr: {
  86                 Name:    "TranDownloadFldr",
  87                 Handler: HandleDownloadFolder,
  88         },
  89         TranGetClientInfoText: {
  90                 Name:    "TranGetClientInfoText",
  91                 Handler: HandleGetClientInfoText,
  92         },
  93         TranGetFileInfo: {
  94                 Name:    "TranGetFileInfo",
  95                 Handler: HandleGetFileInfo,
  96         },
  97         TranGetFileNameList: {
  98                 Name:    "TranGetFileNameList",
  99                 Handler: HandleGetFileNameList,
 100         },
 101         TranGetMsgs: {
 102                 Name:    "TranGetMsgs",
 103                 Handler: HandleGetMsgs,
 104         },
 105         TranGetNewsArtData: {
 106                 Name:    "TranGetNewsArtData",
 107                 Handler: HandleGetNewsArtData,
 108         },
 109         TranGetNewsArtNameList: {
 110                 Name:    "TranGetNewsArtNameList",
 111                 Handler: HandleGetNewsArtNameList,
 112         },
 113         TranGetNewsCatNameList: {
 114                 Name:    "TranGetNewsCatNameList",
 115                 Handler: HandleGetNewsCatNameList,
 116         },
 117         TranGetUser: {
 118                 Name:    "TranGetUser",
 119                 Handler: HandleGetUser,
 120         },
 121         TranGetUserNameList: {
 122                 Name:    "tranHandleGetUserNameList",
 123                 Handler: HandleGetUserNameList,
 124         },
 125         TranInviteNewChat: {
 126                 Name:    "TranInviteNewChat",
 127                 Handler: HandleInviteNewChat,
 128         },
 129         TranInviteToChat: {
 130                 Name:    "TranInviteToChat",
 131                 Handler: HandleInviteToChat,
 132         },
 133         TranJoinChat: {
 134                 Name:    "TranJoinChat",
 135                 Handler: HandleJoinChat,
 136         },
 137         TranKeepAlive: {
 138                 Name:    "TranKeepAlive",
 139                 Handler: HandleKeepAlive,
 140         },
 141         TranLeaveChat: {
 142                 Name:    "TranJoinChat",
 143                 Handler: HandleLeaveChat,
 144         },
 145         TranListUsers: {
 146                 Name:    "TranListUsers",
 147                 Handler: HandleListUsers,
 148         },
 149         TranMoveFile: {
 150                 Name:    "TranMoveFile",
 151                 Handler: HandleMoveFile,
 152         },
 153         TranNewFolder: {
 154                 Name:    "TranNewFolder",
 155                 Handler: HandleNewFolder,
 156         },
 157         TranNewNewsCat: {
 158                 Name:    "TranNewNewsCat",
 159                 Handler: HandleNewNewsCat,
 160         },
 161         TranNewNewsFldr: {
 162                 Name:    "TranNewNewsFldr",
 163                 Handler: HandleNewNewsFldr,
 164         },
 165         TranNewUser: {
 166                 Name:    "TranNewUser",
 167                 Handler: HandleNewUser,
 168         },
 169         TranUpdateUser: {
 170                 Name:    "TranUpdateUser",
 171                 Handler: HandleUpdateUser,
 172         },
 173         TranOldPostNews: {
 174                 Name:    "TranOldPostNews",
 175                 Handler: HandleTranOldPostNews,
 176         },
 177         TranPostNewsArt: {
 178                 Name:    "TranPostNewsArt",
 179                 Handler: HandlePostNewsArt,
 180         },
 181         TranRejectChatInvite: {
 182                 Name:    "TranRejectChatInvite",
 183                 Handler: HandleRejectChatInvite,
 184         },
 185         TranSendInstantMsg: {
 186                 Name:    "TranSendInstantMsg",
 187                 Handler: HandleSendInstantMsg,
 188                 RequiredFields: []requiredField{
 189                         {
 190                                 ID:     FieldData,
 191                                 minLen: 0,
 192                         },
 193                         {
 194                                 ID: FieldUserID,
 195                         },
 196                 },
 197         },
 198         TranSetChatSubject: {
 199                 Name:    "TranSetChatSubject",
 200                 Handler: HandleSetChatSubject,
 201         },
 202         TranMakeFileAlias: {
 203                 Name:    "TranMakeFileAlias",
 204                 Handler: HandleMakeAlias,
 205                 RequiredFields: []requiredField{
 206                         {ID: FieldFileName, minLen: 1},
 207                         {ID: FieldFilePath, minLen: 1},
 208                         {ID: FieldFileNewPath, minLen: 1},
 209                 },
 210         },
 211         TranSetClientUserInfo: {
 212                 Name:    "TranSetClientUserInfo",
 213                 Handler: HandleSetClientUserInfo,
 214         },
 215         TranSetFileInfo: {
 216                 Name:    "TranSetFileInfo",
 217                 Handler: HandleSetFileInfo,
 218         },
 219         TranSetUser: {
 220                 Name:    "TranSetUser",
 221                 Handler: HandleSetUser,
 222         },
 223         TranUploadFile: {
 224                 Name:    "TranUploadFile",
 225                 Handler: HandleUploadFile,
 226         },
 227         TranUploadFldr: {
 228                 Name:    "TranUploadFldr",
 229                 Handler: HandleUploadFolder,
 230         },
 231         TranUserBroadcast: {
 232                 Name:    "TranUserBroadcast",
 233                 Handler: HandleUserBroadcast,
 234         },
 235         TranDownloadBanner: {
 236                 Name:    "TranDownloadBanner",
 237                 Handler: HandleDownloadBanner,
 238         },
 239 }
 240
 241 func HandleChatSend(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 242         if !cc.Authorize(accessSendChat) {
 243                 res = append(res, cc.NewErrReply(t, "You are not allowed to participate in chat."))
 244                 return res, err
 245         }
 246
 247         // Truncate long usernames
 248         trunc := fmt.Sprintf("%13s", cc.UserName)
 249         formattedMsg := fmt.Sprintf("\r%.14s:  %s", trunc, t.GetField(FieldData).Data)
 250
 251         // By holding the option key, Hotline chat allows users to send /me formatted messages like:
 252         // *** Halcyon does stuff
 253         // This is indicated by the presence of the optional field FieldChatOptions set to a value of 1.
 254         // Most clients do not send this option for normal chat messages.
 255         if t.GetField(FieldChatOptions).Data != nil && bytes.Equal(t.GetField(FieldChatOptions).Data, []byte{0, 1}) {
 256                 formattedMsg = fmt.Sprintf("\r*** %s %s", cc.UserName, t.GetField(FieldData).Data)
 257         }
 258
 259         // The ChatID field is used to identify messages as belonging to a private chat.
 260         // All clients *except* Frogblast omit this field for public chat, but Frogblast sends a value of 00 00 00 00.
 261         chatID := t.GetField(FieldChatID).Data
 262         if chatID != nil && !bytes.Equal([]byte{0, 0, 0, 0}, chatID) {
 263                 chatInt := binary.BigEndian.Uint32(chatID)
 264                 privChat := cc.Server.PrivateChats[chatInt]
 265
 266                 clients := sortedClients(privChat.ClientConn)
 267
 268                 // send the message to all connected clients of the private chat
 269                 for _, c := range clients {
 270                         res = append(res, *NewTransaction(
 271                                 TranChatMsg,
 272                                 c.ID,
 273                                 NewField(FieldChatID, chatID),
 274                                 NewField(FieldData, []byte(formattedMsg)),
 275                         ))
 276                 }
 277                 return res, err
 278         }
 279
 280         for _, c := range sortedClients(cc.Server.Clients) {
 281                 // Filter out clients that do not have the read chat permission
 282                 if c.Authorize(accessReadChat) {
 283                         res = append(res, *NewTransaction(TranChatMsg, c.ID, NewField(FieldData, []byte(formattedMsg))))
 284                 }
 285         }
 286
 287         return res, err
 288 }
 289
 290 // HandleSendInstantMsg sends instant message to the user on the current server.
 291 // Fields used in the request:
 292 //
 293 //      103     User ID
 294 //      113     Options
 295 //              One of the following values:
 296 //              - User message (myOpt_UserMessage = 1)
 297 //              - Refuse message (myOpt_RefuseMessage = 2)
 298 //              - Refuse chat (myOpt_RefuseChat  = 3)
 299 //              - Automatic response (myOpt_AutomaticResponse = 4)"
 300 //      101     Data    Optional
 301 //      214     Quoting message Optional
 302 //
 303 // Fields used in the reply:
 304 // None
 305 func HandleSendInstantMsg(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 306         if !cc.Authorize(accessSendPrivMsg) {
 307                 res = append(res, cc.NewErrReply(t, "You are not allowed to send private messages."))
 308                 return res, errors.New("user is not allowed to send private messages")
 309         }
 310
 311         msg := t.GetField(FieldData)
 312         ID := t.GetField(FieldUserID)
 313
 314         reply := NewTransaction(
 315                 TranServerMsg,
 316                 &ID.Data,
 317                 NewField(FieldData, msg.Data),
 318                 NewField(FieldUserName, cc.UserName),
 319                 NewField(FieldUserID, *cc.ID),
 320                 NewField(FieldOptions, []byte{0, 1}),
 321         )
 322
 323         // Later versions of Hotline include the original message in the FieldQuotingMsg field so
 324         //  the receiving client can display both the received message and what it is in reply to
 325         if t.GetField(FieldQuotingMsg).Data != nil {
 326                 reply.Fields = append(reply.Fields, NewField(FieldQuotingMsg, t.GetField(FieldQuotingMsg).Data))
 327         }
 328
 329         id, err := byteToInt(ID.Data)
 330         if err != nil {
 331                 return res, errors.New("invalid client ID")
 332         }
 333         otherClient, ok := cc.Server.Clients[uint16(id)]
 334         if !ok {
 335                 return res, errors.New("invalid client ID")
 336         }
 337
 338         // Check if target user has "Refuse private messages" flag
 339         flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(otherClient.Flags)))
 340         if flagBitmap.Bit(UserFlagRefusePM) == 1 {
 341                 res = append(res,
 342                         *NewTransaction(
 343                                 TranServerMsg,
 344                                 cc.ID,
 345                                 NewField(FieldData, []byte(string(otherClient.UserName)+" does not accept private messages.")),
 346                                 NewField(FieldUserName, otherClient.UserName),
 347                                 NewField(FieldUserID, *otherClient.ID),
 348                                 NewField(FieldOptions, []byte{0, 2}),
 349                         ),
 350                 )
 351         } else {
 352                 res = append(res, *reply)
 353         }
 354
 355         // Respond with auto reply if other client has it enabled
 356         if len(otherClient.AutoReply) > 0 {
 357                 res = append(res,
 358                         *NewTransaction(
 359                                 TranServerMsg,
 360                                 cc.ID,
 361                                 NewField(FieldData, otherClient.AutoReply),
 362                                 NewField(FieldUserName, otherClient.UserName),
 363                                 NewField(FieldUserID, *otherClient.ID),
 364                                 NewField(FieldOptions, []byte{0, 1}),
 365                         ),
 366                 )
 367         }
 368
 369         res = append(res, cc.NewReply(t))
 370
 371         return res, err
 372 }
 373
 374 func HandleGetFileInfo(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 375         fileName := t.GetField(FieldFileName).Data
 376         filePath := t.GetField(FieldFilePath).Data
 377
 378         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
 379         if err != nil {
 380                 return res, err
 381         }
 382
 383         fw, err := newFileWrapper(cc.Server.FS, fullFilePath, 0)
 384         if err != nil {
 385                 return res, err
 386         }
 387
 388         encodedName, err := txtEncoder.String(fw.name)
 389         if err != nil {
 390                 return res, fmt.Errorf("invalid filepath encoding: %w", err)
 391         }
 392
 393         fields := []Field{
 394                 NewField(FieldFileName, []byte(encodedName)),
 395                 NewField(FieldFileTypeString, fw.ffo.FlatFileInformationFork.friendlyType()),
 396                 NewField(FieldFileCreatorString, fw.ffo.FlatFileInformationFork.friendlyCreator()),
 397                 NewField(FieldFileType, fw.ffo.FlatFileInformationFork.TypeSignature),
 398                 NewField(FieldFileCreateDate, fw.ffo.FlatFileInformationFork.CreateDate),
 399                 NewField(FieldFileModifyDate, fw.ffo.FlatFileInformationFork.ModifyDate),
 400         }
 401
 402         // Include the optional FileComment field if there is a comment.
 403         if len(fw.ffo.FlatFileInformationFork.Comment) != 0 {
 404                 fields = append(fields, NewField(FieldFileComment, fw.ffo.FlatFileInformationFork.Comment))
 405         }
 406
 407         // Include the FileSize field for files.
 408         if !bytes.Equal(fw.ffo.FlatFileInformationFork.TypeSignature, []byte{0x66, 0x6c, 0x64, 0x72}) {
 409                 fields = append(fields, NewField(FieldFileSize, fw.totalSize()))
 410         }
 411
 412         res = append(res, cc.NewReply(t, fields...))
 413         return res, err
 414 }
 415
 416 // HandleSetFileInfo updates a file or folder name and/or comment from the Get Info window
 417 // Fields used in the request:
 418 // * 201        File name
 419 // * 202        File path       Optional
 420 // * 211        File new name   Optional
 421 // * 210        File comment    Optional
 422 // Fields used in the reply:    None
 423 func HandleSetFileInfo(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 424         fileName := t.GetField(FieldFileName).Data
 425         filePath := t.GetField(FieldFilePath).Data
 426
 427         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
 428         if err != nil {
 429                 return res, err
 430         }
 431
 432         fi, err := cc.Server.FS.Stat(fullFilePath)
 433         if err != nil {
 434                 return res, err
 435         }
 436
 437         hlFile, err := newFileWrapper(cc.Server.FS, fullFilePath, 0)
 438         if err != nil {
 439                 return res, err
 440         }
 441         if t.GetField(FieldFileComment).Data != nil {
 442                 switch mode := fi.Mode(); {
 443                 case mode.IsDir():
 444                         if !cc.Authorize(accessSetFolderComment) {
 445                                 res = append(res, cc.NewErrReply(t, "You are not allowed to set comments for folders."))
 446                                 return res, err
 447                         }
 448                 case mode.IsRegular():
 449                         if !cc.Authorize(accessSetFileComment) {
 450                                 res = append(res, cc.NewErrReply(t, "You are not allowed to set comments for files."))
 451                                 return res, err
 452                         }
 453                 }
 454
 455                 if err := hlFile.ffo.FlatFileInformationFork.setComment(t.GetField(FieldFileComment).Data); err != nil {
 456                         return res, err
 457                 }
 458                 w, err := hlFile.infoForkWriter()
 459                 if err != nil {
 460                         return res, err
 461                 }
 462                 _, err = w.Write(hlFile.ffo.FlatFileInformationFork.MarshalBinary())
 463                 if err != nil {
 464                         return res, err
 465                 }
 466         }
 467
 468         fullNewFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, t.GetField(FieldFileNewName).Data)
 469         if err != nil {
 470                 return nil, err
 471         }
 472
 473         fileNewName := t.GetField(FieldFileNewName).Data
 474
 475         if fileNewName != nil {
 476                 switch mode := fi.Mode(); {
 477                 case mode.IsDir():
 478                         if !cc.Authorize(accessRenameFolder) {
 479                                 res = append(res, cc.NewErrReply(t, "You are not allowed to rename folders."))
 480                                 return res, err
 481                         }
 482                         err = os.Rename(fullFilePath, fullNewFilePath)
 483                         if os.IsNotExist(err) {
 484                                 res = append(res, cc.NewErrReply(t, "Cannot rename folder "+string(fileName)+" because it does not exist or cannot be found."))
 485                                 return res, err
 486                         }
 487                 case mode.IsRegular():
 488                         if !cc.Authorize(accessRenameFile) {
 489                                 res = append(res, cc.NewErrReply(t, "You are not allowed to rename files."))
 490                                 return res, err
 491                         }
 492                         fileDir, err := readPath(cc.Server.Config.FileRoot, filePath, []byte{})
 493                         if err != nil {
 494                                 return nil, err
 495                         }
 496                         hlFile.name, err = txtDecoder.String(string(fileNewName))
 497                         if err != nil {
 498                                 return res, fmt.Errorf("invalid filepath encoding: %w", err)
 499                         }
 500
 501                         err = hlFile.move(fileDir)
 502                         if os.IsNotExist(err) {
 503                                 res = append(res, cc.NewErrReply(t, "Cannot rename file "+string(fileName)+" because it does not exist or cannot be found."))
 504                                 return res, err
 505                         }
 506                         if err != nil {
 507                                 return res, err
 508                         }
 509                 }
 510         }
 511
 512         res = append(res, cc.NewReply(t))
 513         return res, err
 514 }
 515
 516 // HandleDeleteFile deletes a file or folder
 517 // Fields used in the request:
 518 // * 201        File name
 519 // * 202        File path
 520 // Fields used in the reply: none
 521 func HandleDeleteFile(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 522         fileName := t.GetField(FieldFileName).Data
 523         filePath := t.GetField(FieldFilePath).Data
 524
 525         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
 526         if err != nil {
 527                 return res, err
 528         }
 529
 530         hlFile, err := newFileWrapper(cc.Server.FS, fullFilePath, 0)
 531         if err != nil {
 532                 return res, err
 533         }
 534
 535         fi, err := hlFile.dataFile()
 536         if err != nil {
 537                 res = append(res, cc.NewErrReply(t, "Cannot delete file "+string(fileName)+" because it does not exist or cannot be found."))
 538                 return res, nil
 539         }
 540
 541         switch mode := fi.Mode(); {
 542         case mode.IsDir():
 543                 if !cc.Authorize(accessDeleteFolder) {
 544                         res = append(res, cc.NewErrReply(t, "You are not allowed to delete folders."))
 545                         return res, err
 546                 }
 547         case mode.IsRegular():
 548                 if !cc.Authorize(accessDeleteFile) {
 549                         res = append(res, cc.NewErrReply(t, "You are not allowed to delete files."))
 550                         return res, err
 551                 }
 552         }
 553
 554         if err := hlFile.delete(); err != nil {
 555                 return res, err
 556         }
 557
 558         res = append(res, cc.NewReply(t))
 559         return res, err
 560 }
 561
 562 // HandleMoveFile moves files or folders. Note: seemingly not documented
 563 func HandleMoveFile(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 564         fileName := string(t.GetField(FieldFileName).Data)
 565
 566         filePath, err := readPath(cc.Server.Config.FileRoot, t.GetField(FieldFilePath).Data, t.GetField(FieldFileName).Data)
 567         if err != nil {
 568                 return res, err
 569         }
 570
 571         fileNewPath, err := readPath(cc.Server.Config.FileRoot, t.GetField(FieldFileNewPath).Data, nil)
 572         if err != nil {
 573                 return res, err
 574         }
 575
 576         cc.logger.Infow("Move file", "src", filePath+"/"+fileName, "dst", fileNewPath+"/"+fileName)
 577
 578         hlFile, err := newFileWrapper(cc.Server.FS, filePath, 0)
 579         if err != nil {
 580                 return res, err
 581         }
 582
 583         fi, err := hlFile.dataFile()
 584         if err != nil {
 585                 res = append(res, cc.NewErrReply(t, "Cannot delete file "+fileName+" because it does not exist or cannot be found."))
 586                 return res, err
 587         }
 588         switch mode := fi.Mode(); {
 589         case mode.IsDir():
 590                 if !cc.Authorize(accessMoveFolder) {
 591                         res = append(res, cc.NewErrReply(t, "You are not allowed to move folders."))
 592                         return res, err
 593                 }
 594         case mode.IsRegular():
 595                 if !cc.Authorize(accessMoveFile) {
 596                         res = append(res, cc.NewErrReply(t, "You are not allowed to move files."))
 597                         return res, err
 598                 }
 599         }
 600         if err := hlFile.move(fileNewPath); err != nil {
 601                 return res, err
 602         }
 603         // TODO: handle other possible errors; e.g. fileWrapper delete fails due to fileWrapper permission issue
 604
 605         res = append(res, cc.NewReply(t))
 606         return res, err
 607 }
 608
 609 func HandleNewFolder(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 610         if !cc.Authorize(accessCreateFolder) {
 611                 res = append(res, cc.NewErrReply(t, "You are not allowed to create folders."))
 612                 return res, err
 613         }
 614         folderName := string(t.GetField(FieldFileName).Data)
 615
 616         folderName = path.Join("/", folderName)
 617
 618         var subPath string
 619
 620         // FieldFilePath is only present for nested paths
 621         if t.GetField(FieldFilePath).Data != nil {
 622                 var newFp FilePath
 623                 _, err := newFp.Write(t.GetField(FieldFilePath).Data)
 624                 if err != nil {
 625                         return nil, err
 626                 }
 627
 628                 for _, pathItem := range newFp.Items {
 629                         subPath = filepath.Join("/", subPath, string(pathItem.Name))
 630                 }
 631         }
 632         newFolderPath := path.Join(cc.Server.Config.FileRoot, subPath, folderName)
 633         newFolderPath, err = txtDecoder.String(newFolderPath)
 634         if err != nil {
 635                 return res, fmt.Errorf("invalid filepath encoding: %w", err)
 636         }
 637
 638         // TODO: check path and folder name lengths
 639
 640         if _, err := cc.Server.FS.Stat(newFolderPath); !os.IsNotExist(err) {
 641                 msg := fmt.Sprintf("Cannot create folder \"%s\" because there is already a file or folder with that name.", folderName)
 642                 return []Transaction{cc.NewErrReply(t, msg)}, nil
 643         }
 644
 645         if err := cc.Server.FS.Mkdir(newFolderPath, 0777); err != nil {
 646                 msg := fmt.Sprintf("Cannot create folder \"%s\" because an error occurred.", folderName)
 647                 return []Transaction{cc.NewErrReply(t, msg)}, nil
 648         }
 649
 650         res = append(res, cc.NewReply(t))
 651         return res, err
 652 }
 653
 654 func HandleSetUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 655         if !cc.Authorize(accessModifyUser) {
 656                 res = append(res, cc.NewErrReply(t, "You are not allowed to modify accounts."))
 657                 return res, err
 658         }
 659
 660         login := decodeString(t.GetField(FieldUserLogin).Data)
 661         userName := string(t.GetField(FieldUserName).Data)
 662
 663         newAccessLvl := t.GetField(FieldUserAccess).Data
 664
 665         account := cc.Server.Accounts[login]
 666         if account == nil {
 667                 return append(res, cc.NewErrReply(t, "Account not found.")), nil
 668         }
 669         account.Name = userName
 670         copy(account.Access[:], newAccessLvl)
 671
 672         // If the password field is cleared in the Hotline edit user UI, the SetUser transaction does
 673         // not include FieldUserPassword
 674         if t.GetField(FieldUserPassword).Data == nil {
 675                 account.Password = hashAndSalt([]byte(""))
 676         }
 677
 678         if !bytes.Equal([]byte{0}, t.GetField(FieldUserPassword).Data) {
 679                 account.Password = hashAndSalt(t.GetField(FieldUserPassword).Data)
 680         }
 681
 682         out, err := yaml.Marshal(&account)
 683         if err != nil {
 684                 return res, err
 685         }
 686         if err := os.WriteFile(filepath.Join(cc.Server.ConfigDir, "Users", login+".yaml"), out, 0666); err != nil {
 687                 return res, err
 688         }
 689
 690         // Notify connected clients logged in as the user of the new access level
 691         for _, c := range cc.Server.Clients {
 692                 if c.Account.Login == login {
 693                         // Note: comment out these two lines to test server-side deny messages
 694                         newT := NewTransaction(TranUserAccess, c.ID, NewField(FieldUserAccess, newAccessLvl))
 695                         res = append(res, *newT)
 696
 697                         flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(c.Flags)))
 698                         if c.Authorize(accessDisconUser) {
 699                                 flagBitmap.SetBit(flagBitmap, UserFlagAdmin, 1)
 700                         } else {
 701                                 flagBitmap.SetBit(flagBitmap, UserFlagAdmin, 0)
 702                         }
 703                         binary.BigEndian.PutUint16(c.Flags, uint16(flagBitmap.Int64()))
 704
 705                         c.Account.Access = account.Access
 706
 707                         cc.sendAll(
 708                                 TranNotifyChangeUser,
 709                                 NewField(FieldUserID, *c.ID),
 710                                 NewField(FieldUserFlags, c.Flags),
 711                                 NewField(FieldUserName, c.UserName),
 712                                 NewField(FieldUserIconID, c.Icon),
 713                         )
 714                 }
 715         }
 716
 717         res = append(res, cc.NewReply(t))
 718         return res, err
 719 }
 720
 721 func HandleGetUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 722         if !cc.Authorize(accessOpenUser) {
 723                 res = append(res, cc.NewErrReply(t, "You are not allowed to view accounts."))
 724                 return res, err
 725         }
 726
 727         account := cc.Server.Accounts[string(t.GetField(FieldUserLogin).Data)]
 728         if account == nil {
 729                 res = append(res, cc.NewErrReply(t, "Account does not exist."))
 730                 return res, err
 731         }
 732
 733         res = append(res, cc.NewReply(t,
 734                 NewField(FieldUserName, []byte(account.Name)),
 735                 NewField(FieldUserLogin, encodeString(t.GetField(FieldUserLogin).Data)),
 736                 NewField(FieldUserPassword, []byte(account.Password)),
 737                 NewField(FieldUserAccess, account.Access[:]),
 738         ))
 739         return res, err
 740 }
 741
 742 func HandleListUsers(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 743         if !cc.Authorize(accessOpenUser) {
 744                 res = append(res, cc.NewErrReply(t, "You are not allowed to view accounts."))
 745                 return res, err
 746         }
 747
 748         var userFields []Field
 749         for _, acc := range cc.Server.Accounts {
 750                 b := make([]byte, 0, 100)
 751                 n, err := acc.Read(b)
 752                 if err != nil {
 753                         return res, err
 754                 }
 755
 756                 userFields = append(userFields, NewField(FieldData, b[:n]))
 757         }
 758
 759         res = append(res, cc.NewReply(t, userFields...))
 760         return res, err
 761 }
 762
 763 // HandleUpdateUser is used by the v1.5+ multi-user editor to perform account editing for multiple users at a time.
 764 // An update can be a mix of these actions:
 765 // * Create user
 766 // * Delete user
 767 // * Modify user (including renaming the account login)
 768 //
 769 // The Transaction sent by the client includes one data field per user that was modified.  This data field in turn
 770 // contains another data field encoded in its payload with a varying number of sub fields depending on which action is
 771 // performed.  This seems to be the only place in the Hotline protocol where a data field contains another data field.
 772 func HandleUpdateUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 773         for _, field := range t.Fields {
 774                 subFields, err := ReadFields(field.Data[0:2], field.Data[2:])
 775                 if err != nil {
 776                         return res, err
 777                 }
 778
 779                 if len(subFields) == 1 {
 780                         login := decodeString(getField(FieldData, &subFields).Data)
 781                         cc.logger.Infow("DeleteUser", "login", login)
 782
 783                         if !cc.Authorize(accessDeleteUser) {
 784                                 res = append(res, cc.NewErrReply(t, "You are not allowed to delete accounts."))
 785                                 return res, err
 786                         }
 787
 788                         if err := cc.Server.DeleteUser(login); err != nil {
 789                                 return res, err
 790                         }
 791                         continue
 792                 }
 793
 794                 login := decodeString(getField(FieldUserLogin, &subFields).Data)
 795
 796                 // check if the login dataFile; if so, we know we are updating an existing user
 797                 if acc, ok := cc.Server.Accounts[login]; ok {
 798                         cc.logger.Infow("UpdateUser", "login", login)
 799
 800                         // account exists, so this is an update action
 801                         if !cc.Authorize(accessModifyUser) {
 802                                 res = append(res, cc.NewErrReply(t, "You are not allowed to modify accounts."))
 803                                 return res, nil
 804                         }
 805
 806                         // This part is a bit tricky. There are three possibilities:
 807                         // 1) The transaction is intended to update the password.
 808                         //        In this case, FieldUserPassword is sent with the new password.
 809                         // 2) The transaction is intended to remove the password.
 810                         //    In this case, FieldUserPassword is not sent.
 811                         // 3) The transaction updates the users access bits, but not the password.
 812                         //    In this case, FieldUserPassword is sent with zero as the only byte.
 813                         if getField(FieldUserPassword, &subFields) != nil {
 814                                 newPass := getField(FieldUserPassword, &subFields).Data
 815                                 if !bytes.Equal([]byte{0}, newPass) {
 816                                         acc.Password = hashAndSalt(newPass)
 817                                 }
 818                         } else {
 819                                 acc.Password = hashAndSalt([]byte(""))
 820                         }
 821
 822                         if getField(FieldUserAccess, &subFields) != nil {
 823                                 copy(acc.Access[:], getField(FieldUserAccess, &subFields).Data)
 824                         }
 825
 826                         err = cc.Server.UpdateUser(
 827                                 decodeString(getField(FieldData, &subFields).Data),
 828                                 decodeString(getField(FieldUserLogin, &subFields).Data),
 829                                 string(getField(FieldUserName, &subFields).Data),
 830                                 acc.Password,
 831                                 acc.Access,
 832                         )
 833                         if err != nil {
 834                                 return res, err
 835                         }
 836                 } else {
 837                         cc.logger.Infow("CreateUser", "login", login)
 838
 839                         if !cc.Authorize(accessCreateUser) {
 840                                 res = append(res, cc.NewErrReply(t, "You are not allowed to create new accounts."))
 841                                 return res, nil
 842                         }
 843
 844                         newAccess := accessBitmap{}
 845                         copy(newAccess[:], getField(FieldUserAccess, &subFields).Data)
 846
 847                         // Prevent account from creating new account with greater permission
 848                         for i := 0; i < 64; i++ {
 849                                 if newAccess.IsSet(i) {
 850                                         if !cc.Authorize(i) {
 851                                                 return append(res, cc.NewErrReply(t, "Cannot create account with more access than yourself.")), nil
 852                                         }
 853                                 }
 854                         }
 855
 856                         err = cc.Server.NewUser(login, string(getField(FieldUserName, &subFields).Data), string(getField(FieldUserPassword, &subFields).Data), newAccess)
 857                         if err != nil {
 858                                 return append(res, cc.NewErrReply(t, "Cannot create account because there is already an account with that login.")), nil
 859                         }
 860                 }
 861         }
 862
 863         res = append(res, cc.NewReply(t))
 864         return res, err
 865 }
 866
 867 // HandleNewUser creates a new user account
 868 func HandleNewUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 869         if !cc.Authorize(accessCreateUser) {
 870                 res = append(res, cc.NewErrReply(t, "You are not allowed to create new accounts."))
 871                 return res, err
 872         }
 873
 874         login := decodeString(t.GetField(FieldUserLogin).Data)
 875
 876         // If the account already dataFile, reply with an error
 877         if _, ok := cc.Server.Accounts[login]; ok {
 878                 res = append(res, cc.NewErrReply(t, "Cannot create account "+login+" because there is already an account with that login."))
 879                 return res, err
 880         }
 881
 882         newAccess := accessBitmap{}
 883         copy(newAccess[:], t.GetField(FieldUserAccess).Data)
 884
 885         // Prevent account from creating new account with greater permission
 886         for i := 0; i < 64; i++ {
 887                 if newAccess.IsSet(i) {
 888                         if !cc.Authorize(i) {
 889                                 res = append(res, cc.NewErrReply(t, "Cannot create account with more access than yourself."))
 890                                 return res, err
 891                         }
 892                 }
 893         }
 894
 895         if err := cc.Server.NewUser(login, string(t.GetField(FieldUserName).Data), string(t.GetField(FieldUserPassword).Data), newAccess); err != nil {
 896                 res = append(res, cc.NewErrReply(t, "Cannot create account because there is already an account with that login."))
 897                 return res, err
 898         }
 899
 900         res = append(res, cc.NewReply(t))
 901         return res, err
 902 }
 903
 904 func HandleDeleteUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 905         if !cc.Authorize(accessDeleteUser) {
 906                 res = append(res, cc.NewErrReply(t, "You are not allowed to delete accounts."))
 907                 return res, nil
 908         }
 909
 910         login := decodeString(t.GetField(FieldUserLogin).Data)
 911
 912         if err := cc.Server.DeleteUser(login); err != nil {
 913                 return res, err
 914         }
 915
 916         res = append(res, cc.NewReply(t))
 917         return res, err
 918 }
 919
 920 // HandleUserBroadcast sends an Administrator Message to all connected clients of the server
 921 func HandleUserBroadcast(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 922         if !cc.Authorize(accessBroadcast) {
 923                 res = append(res, cc.NewErrReply(t, "You are not allowed to send broadcast messages."))
 924                 return res, err
 925         }
 926
 927         cc.sendAll(
 928                 TranServerMsg,
 929                 NewField(FieldData, t.GetField(TranGetMsgs).Data),
 930                 NewField(FieldChatOptions, []byte{0}),
 931         )
 932
 933         res = append(res, cc.NewReply(t))
 934         return res, err
 935 }
 936
 937 // HandleGetClientInfoText returns user information for the specific user.
 938 //
 939 // Fields used in the request:
 940 // 103  User ID
 941 //
 942 // Fields used in the reply:
 943 // 102  User name
 944 // 101  Data            User info text string
 945 func HandleGetClientInfoText(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 946         if !cc.Authorize(accessGetClientInfo) {
 947                 res = append(res, cc.NewErrReply(t, "You are not allowed to get client info."))
 948                 return res, err
 949         }
 950
 951         clientID, _ := byteToInt(t.GetField(FieldUserID).Data)
 952
 953         clientConn := cc.Server.Clients[uint16(clientID)]
 954         if clientConn == nil {
 955                 return append(res, cc.NewErrReply(t, "User not found.")), err
 956         }
 957
 958         res = append(res, cc.NewReply(t,
 959                 NewField(FieldData, []byte(clientConn.String())),
 960                 NewField(FieldUserName, clientConn.UserName),
 961         ))
 962         return res, err
 963 }
 964
 965 func HandleGetUserNameList(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 966         res = append(res, cc.NewReply(t, cc.Server.connectedUsers()...))
 967
 968         return res, err
 969 }
 970
 971 func HandleTranAgreed(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 972         if t.GetField(FieldUserName).Data != nil {
 973                 if cc.Authorize(accessAnyName) {
 974                         cc.UserName = t.GetField(FieldUserName).Data
 975                 } else {
 976                         cc.UserName = []byte(cc.Account.Name)
 977                 }
 978         }
 979
 980         cc.Icon = t.GetField(FieldUserIconID).Data
 981
 982         cc.logger = cc.logger.With("name", string(cc.UserName))
 983         cc.logger.Infow("Login successful", "clientVersion", fmt.Sprintf("%v", func() int { i, _ := byteToInt(cc.Version); return i }()))
 984
 985         options := t.GetField(FieldOptions).Data
 986         optBitmap := big.NewInt(int64(binary.BigEndian.Uint16(options)))
 987
 988         flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(cc.Flags)))
 989
 990         // Check refuse private PM option
 991         if optBitmap.Bit(refusePM) == 1 {
 992                 flagBitmap.SetBit(flagBitmap, UserFlagRefusePM, 1)
 993                 binary.BigEndian.PutUint16(cc.Flags, uint16(flagBitmap.Int64()))
 994         }
 995
 996         // Check refuse private chat option
 997         if optBitmap.Bit(refuseChat) == 1 {
 998                 flagBitmap.SetBit(flagBitmap, UserFlagRefusePChat, 1)
 999                 binary.BigEndian.PutUint16(cc.Flags, uint16(flagBitmap.Int64()))
1000         }
1001
1002         // Check auto response
1003         if optBitmap.Bit(autoResponse) == 1 {
1004                 cc.AutoReply = t.GetField(FieldAutomaticResponse).Data
1005         } else {
1006                 cc.AutoReply = []byte{}
1007         }
1008
1009         trans := cc.notifyOthers(
1010                 *NewTransaction(
1011                         TranNotifyChangeUser, nil,
1012                         NewField(FieldUserName, cc.UserName),
1013                         NewField(FieldUserID, *cc.ID),
1014                         NewField(FieldUserIconID, cc.Icon),
1015                         NewField(FieldUserFlags, cc.Flags),
1016                 ),
1017         )
1018         res = append(res, trans...)
1019
1020         if cc.Server.Config.BannerFile != "" {
1021                 res = append(res, *NewTransaction(TranServerBanner, cc.ID, NewField(FieldBannerType, []byte("JPEG"))))
1022         }
1023
1024         res = append(res, cc.NewReply(t))
1025
1026         return res, err
1027 }
1028
1029 // HandleTranOldPostNews updates the flat news
1030 // Fields used in this request:
1031 // 101  Data
1032 func HandleTranOldPostNews(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1033         if !cc.Authorize(accessNewsPostArt) {
1034                 res = append(res, cc.NewErrReply(t, "You are not allowed to post news."))
1035                 return res, err
1036         }
1037
1038         cc.Server.flatNewsMux.Lock()
1039         defer cc.Server.flatNewsMux.Unlock()
1040
1041         newsDateTemplate := defaultNewsDateFormat
1042         if cc.Server.Config.NewsDateFormat != "" {
1043                 newsDateTemplate = cc.Server.Config.NewsDateFormat
1044         }
1045
1046         newsTemplate := defaultNewsTemplate
1047         if cc.Server.Config.NewsDelimiter != "" {
1048                 newsTemplate = cc.Server.Config.NewsDelimiter
1049         }
1050
1051         newsPost := fmt.Sprintf(newsTemplate+"\r", cc.UserName, time.Now().Format(newsDateTemplate), t.GetField(FieldData).Data)
1052         newsPost = strings.ReplaceAll(newsPost, "\n", "\r")
1053
1054         // update news in memory
1055         cc.Server.FlatNews = append([]byte(newsPost), cc.Server.FlatNews...)
1056
1057         // update news on disk
1058         if err := cc.Server.FS.WriteFile(filepath.Join(cc.Server.ConfigDir, "MessageBoard.txt"), cc.Server.FlatNews, 0644); err != nil {
1059                 return res, err
1060         }
1061
1062         // Notify all clients of updated news
1063         cc.sendAll(
1064                 TranNewMsg,
1065                 NewField(FieldData, []byte(newsPost)),
1066         )
1067
1068         res = append(res, cc.NewReply(t))
1069         return res, err
1070 }
1071
1072 func HandleDisconnectUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1073         if !cc.Authorize(accessDisconUser) {
1074                 res = append(res, cc.NewErrReply(t, "You are not allowed to disconnect users."))
1075                 return res, err
1076         }
1077
1078         clientConn := cc.Server.Clients[binary.BigEndian.Uint16(t.GetField(FieldUserID).Data)]
1079
1080         if clientConn.Authorize(accessCannotBeDiscon) {
1081                 res = append(res, cc.NewErrReply(t, clientConn.Account.Login+" is not allowed to be disconnected."))
1082                 return res, err
1083         }
1084
1085         // If FieldOptions is set, then the client IP is banned in addition to disconnected.
1086         // 00 01 = temporary ban
1087         // 00 02 = permanent ban
1088         if t.GetField(FieldOptions).Data != nil {
1089                 switch t.GetField(FieldOptions).Data[1] {
1090                 case 1:
1091                         // send message: "You are temporarily banned on this server"
1092                         cc.logger.Infow("Disconnect & temporarily ban " + string(clientConn.UserName))
1093
1094                         res = append(res, *NewTransaction(
1095                                 TranServerMsg,
1096                                 clientConn.ID,
1097                                 NewField(FieldData, []byte("You are temporarily banned on this server")),
1098                                 NewField(FieldChatOptions, []byte{0, 0}),
1099                         ))
1100
1101                         banUntil := time.Now().Add(tempBanDuration)
1102                         cc.Server.banList[strings.Split(clientConn.RemoteAddr, ":")[0]] = &banUntil
1103                 case 2:
1104                         // send message: "You are permanently banned on this server"
1105                         cc.logger.Infow("Disconnect & ban " + string(clientConn.UserName))
1106
1107                         res = append(res, *NewTransaction(
1108                                 TranServerMsg,
1109                                 clientConn.ID,
1110                                 NewField(FieldData, []byte("You are permanently banned on this server")),
1111                                 NewField(FieldChatOptions, []byte{0, 0}),
1112                         ))
1113
1114                         cc.Server.banList[strings.Split(clientConn.RemoteAddr, ":")[0]] = nil
1115                 }
1116
1117                 err := cc.Server.writeBanList()
1118                 if err != nil {
1119                         return res, err
1120                 }
1121         }
1122
1123         // TODO: remove this awful hack
1124         go func() {
1125                 time.Sleep(1 * time.Second)
1126                 clientConn.Disconnect()
1127         }()
1128
1129         return append(res, cc.NewReply(t)), err
1130 }
1131
1132 // HandleGetNewsCatNameList returns a list of news categories for a path
1133 // Fields used in the request:
1134 // 325  News path       (Optional)
1135 func HandleGetNewsCatNameList(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1136         if !cc.Authorize(accessNewsReadArt) {
1137                 res = append(res, cc.NewErrReply(t, "You are not allowed to read news."))
1138                 return res, err
1139         }
1140
1141         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1142         cats := cc.Server.GetNewsCatByPath(pathStrs)
1143
1144         // To store the keys in slice in sorted order
1145         keys := make([]string, len(cats))
1146         i := 0
1147         for k := range cats {
1148                 keys[i] = k
1149                 i++
1150         }
1151         sort.Strings(keys)
1152
1153         var fieldData []Field
1154         for _, k := range keys {
1155                 cat := cats[k]
1156                 b, _ := cat.MarshalBinary()
1157                 fieldData = append(fieldData, NewField(
1158                         FieldNewsCatListData15,
1159                         b,
1160                 ))
1161         }
1162
1163         res = append(res, cc.NewReply(t, fieldData...))
1164         return res, err
1165 }
1166
1167 func HandleNewNewsCat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1168         if !cc.Authorize(accessNewsCreateCat) {
1169                 res = append(res, cc.NewErrReply(t, "You are not allowed to create news categories."))
1170                 return res, err
1171         }
1172
1173         name := string(t.GetField(FieldNewsCatName).Data)
1174         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1175
1176         cats := cc.Server.GetNewsCatByPath(pathStrs)
1177         cats[name] = NewsCategoryListData15{
1178                 Name:     name,
1179                 Type:     []byte{0, 3},
1180                 Articles: map[uint32]*NewsArtData{},
1181                 SubCats:  make(map[string]NewsCategoryListData15),
1182         }
1183
1184         if err := cc.Server.writeThreadedNews(); err != nil {
1185                 return res, err
1186         }
1187         res = append(res, cc.NewReply(t))
1188         return res, err
1189 }
1190
1191 // Fields used in the request:
1192 // 322  News category name
1193 // 325  News path
1194 func HandleNewNewsFldr(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1195         if !cc.Authorize(accessNewsCreateFldr) {
1196                 res = append(res, cc.NewErrReply(t, "You are not allowed to create news folders."))
1197                 return res, err
1198         }
1199
1200         name := string(t.GetField(FieldFileName).Data)
1201         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1202
1203         cc.logger.Infof("Creating new news folder %s", name)
1204
1205         cats := cc.Server.GetNewsCatByPath(pathStrs)
1206         cats[name] = NewsCategoryListData15{
1207                 Name:     name,
1208                 Type:     []byte{0, 2},
1209                 Articles: map[uint32]*NewsArtData{},
1210                 SubCats:  make(map[string]NewsCategoryListData15),
1211         }
1212         if err := cc.Server.writeThreadedNews(); err != nil {
1213                 return res, err
1214         }
1215         res = append(res, cc.NewReply(t))
1216         return res, err
1217 }
1218
1219 // HandleGetNewsArtData gets the list of article names at the specified news path.
1220
1221 // Fields used in the request:
1222 // 325  News path       Optional
1223
1224 // Fields used in the reply:
1225 // 321  News article list data  Optional
1226 func HandleGetNewsArtNameList(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1227         if !cc.Authorize(accessNewsReadArt) {
1228                 res = append(res, cc.NewErrReply(t, "You are not allowed to read news."))
1229                 return res, err
1230         }
1231         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1232
1233         var cat NewsCategoryListData15
1234         cats := cc.Server.ThreadedNews.Categories
1235
1236         for _, fp := range pathStrs {
1237                 cat = cats[fp]
1238                 cats = cats[fp].SubCats
1239         }
1240
1241         nald := cat.GetNewsArtListData()
1242
1243         res = append(res, cc.NewReply(t, NewField(FieldNewsArtListData, nald.Payload())))
1244         return res, err
1245 }
1246
1247 // HandleGetNewsArtData requests information about the specific news article.
1248 // Fields used in the request:
1249 //
1250 // Request fields
1251 // 325  News path
1252 // 326  News article ID
1253 // 327  News article data flavor
1254 //
1255 // Fields used in the reply:
1256 // 328  News article title
1257 // 329  News article poster
1258 // 330  News article date
1259 // 331  Previous article ID
1260 // 332  Next article ID
1261 // 335  Parent article ID
1262 // 336  First child article ID
1263 // 327  News article data flavor        "Should be “text/plain”
1264 // 333  News article data       Optional (if data flavor is “text/plain”)
1265 func HandleGetNewsArtData(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1266         if !cc.Authorize(accessNewsReadArt) {
1267                 res = append(res, cc.NewErrReply(t, "You are not allowed to read news."))
1268                 return res, err
1269         }
1270
1271         var cat NewsCategoryListData15
1272         cats := cc.Server.ThreadedNews.Categories
1273
1274         for _, fp := range ReadNewsPath(t.GetField(FieldNewsPath).Data) {
1275                 cat = cats[fp]
1276                 cats = cats[fp].SubCats
1277         }
1278
1279         // The official Hotline clients will send the article ID as 2 bytes if possible, but
1280         // some third party clients such as Frogblast and Heildrun will always send 4 bytes
1281         convertedID, err := byteToInt(t.GetField(FieldNewsArtID).Data)
1282         if err != nil {
1283                 return res, err
1284         }
1285
1286         art := cat.Articles[uint32(convertedID)]
1287         if art == nil {
1288                 res = append(res, cc.NewReply(t))
1289                 return res, err
1290         }
1291
1292         res = append(res, cc.NewReply(t,
1293                 NewField(FieldNewsArtTitle, []byte(art.Title)),
1294                 NewField(FieldNewsArtPoster, []byte(art.Poster)),
1295                 NewField(FieldNewsArtDate, art.Date),
1296                 NewField(FieldNewsArtPrevArt, art.PrevArt),
1297                 NewField(FieldNewsArtNextArt, art.NextArt),
1298                 NewField(FieldNewsArtParentArt, art.ParentArt),
1299                 NewField(FieldNewsArt1stChildArt, art.FirstChildArt),
1300                 NewField(FieldNewsArtDataFlav, []byte("text/plain")),
1301                 NewField(FieldNewsArtData, []byte(art.Data)),
1302         ))
1303         return res, err
1304 }
1305
1306 // HandleDelNewsItem deletes an existing threaded news folder or category from the server.
1307 // Fields used in the request:
1308 // 325  News path
1309 // Fields used in the reply:
1310 // None
1311 func HandleDelNewsItem(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1312         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1313
1314         cats := cc.Server.ThreadedNews.Categories
1315         delName := pathStrs[len(pathStrs)-1]
1316         if len(pathStrs) > 1 {
1317                 for _, fp := range pathStrs[0 : len(pathStrs)-1] {
1318                         cats = cats[fp].SubCats
1319                 }
1320         }
1321
1322         if bytes.Equal(cats[delName].Type, []byte{0, 3}) {
1323                 if !cc.Authorize(accessNewsDeleteCat) {
1324                         return append(res, cc.NewErrReply(t, "You are not allowed to delete news categories.")), nil
1325                 }
1326         } else {
1327                 if !cc.Authorize(accessNewsDeleteFldr) {
1328                         return append(res, cc.NewErrReply(t, "You are not allowed to delete news folders.")), nil
1329                 }
1330         }
1331
1332         delete(cats, delName)
1333
1334         if err := cc.Server.writeThreadedNews(); err != nil {
1335                 return res, err
1336         }
1337
1338         return append(res, cc.NewReply(t)), nil
1339 }
1340
1341 func HandleDelNewsArt(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1342         if !cc.Authorize(accessNewsDeleteArt) {
1343                 res = append(res, cc.NewErrReply(t, "You are not allowed to delete news articles."))
1344                 return res, err
1345         }
1346
1347         // Request Fields
1348         // 325  News path
1349         // 326  News article ID
1350         // 337  News article – recursive delete       Delete child articles (1) or not (0)
1351         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1352         ID, err := byteToInt(t.GetField(FieldNewsArtID).Data)
1353         if err != nil {
1354                 return res, err
1355         }
1356
1357         // TODO: Delete recursive
1358         cats := cc.Server.GetNewsCatByPath(pathStrs[:len(pathStrs)-1])
1359
1360         catName := pathStrs[len(pathStrs)-1]
1361         cat := cats[catName]
1362
1363         delete(cat.Articles, uint32(ID))
1364
1365         cats[catName] = cat
1366         if err := cc.Server.writeThreadedNews(); err != nil {
1367                 return res, err
1368         }
1369
1370         res = append(res, cc.NewReply(t))
1371         return res, err
1372 }
1373
1374 // Request fields
1375 // 325  News path
1376 // 326  News article ID                                                 ID of the parent article?
1377 // 328  News article title
1378 // 334  News article flags
1379 // 327  News article data flavor                Currently “text/plain”
1380 // 333  News article data
1381 func HandlePostNewsArt(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1382         if !cc.Authorize(accessNewsPostArt) {
1383                 res = append(res, cc.NewErrReply(t, "You are not allowed to post news articles."))
1384                 return res, err
1385         }
1386
1387         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1388         cats := cc.Server.GetNewsCatByPath(pathStrs[:len(pathStrs)-1])
1389
1390         catName := pathStrs[len(pathStrs)-1]
1391         cat := cats[catName]
1392
1393         artID, err := byteToInt(t.GetField(FieldNewsArtID).Data)
1394         if err != nil {
1395                 return res, err
1396         }
1397         convertedArtID := uint32(artID)
1398         bs := make([]byte, 4)
1399         binary.BigEndian.PutUint32(bs, convertedArtID)
1400
1401         newArt := NewsArtData{
1402                 Title:         string(t.GetField(FieldNewsArtTitle).Data),
1403                 Poster:        string(cc.UserName),
1404                 Date:          toHotlineTime(time.Now()),
1405                 PrevArt:       []byte{0, 0, 0, 0},
1406                 NextArt:       []byte{0, 0, 0, 0},
1407                 ParentArt:     bs,
1408                 FirstChildArt: []byte{0, 0, 0, 0},
1409                 DataFlav:      []byte("text/plain"),
1410                 Data:          string(t.GetField(FieldNewsArtData).Data),
1411         }
1412
1413         var keys []int
1414         for k := range cat.Articles {
1415                 keys = append(keys, int(k))
1416         }
1417
1418         nextID := uint32(1)
1419         if len(keys) > 0 {
1420                 sort.Ints(keys)
1421                 prevID := uint32(keys[len(keys)-1])
1422                 nextID = prevID + 1
1423
1424                 binary.BigEndian.PutUint32(newArt.PrevArt, prevID)
1425
1426                 // Set next article ID
1427                 binary.BigEndian.PutUint32(cat.Articles[prevID].NextArt, nextID)
1428         }
1429
1430         // Update parent article with first child reply
1431         parentID := convertedArtID
1432         if parentID != 0 {
1433                 parentArt := cat.Articles[parentID]
1434
1435                 if bytes.Equal(parentArt.FirstChildArt, []byte{0, 0, 0, 0}) {
1436                         binary.BigEndian.PutUint32(parentArt.FirstChildArt, nextID)
1437                 }
1438         }
1439
1440         cat.Articles[nextID] = &newArt
1441
1442         cats[catName] = cat
1443         if err := cc.Server.writeThreadedNews(); err != nil {
1444                 return res, err
1445         }
1446
1447         res = append(res, cc.NewReply(t))
1448         return res, err
1449 }
1450
1451 // HandleGetMsgs returns the flat news data
1452 func HandleGetMsgs(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1453         if !cc.Authorize(accessNewsReadArt) {
1454                 res = append(res, cc.NewErrReply(t, "You are not allowed to read news."))
1455                 return res, err
1456         }
1457
1458         res = append(res, cc.NewReply(t, NewField(FieldData, cc.Server.FlatNews)))
1459
1460         return res, err
1461 }
1462
1463 func HandleDownloadFile(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1464         if !cc.Authorize(accessDownloadFile) {
1465                 res = append(res, cc.NewErrReply(t, "You are not allowed to download files."))
1466                 return res, err
1467         }
1468
1469         fileName := t.GetField(FieldFileName).Data
1470         filePath := t.GetField(FieldFilePath).Data
1471         resumeData := t.GetField(FieldFileResumeData).Data
1472
1473         var dataOffset int64
1474         var frd FileResumeData
1475         if resumeData != nil {
1476                 if err := frd.UnmarshalBinary(t.GetField(FieldFileResumeData).Data); err != nil {
1477                         return res, err
1478                 }
1479                 // TODO: handle rsrc fork offset
1480                 dataOffset = int64(binary.BigEndian.Uint32(frd.ForkInfoList[0].DataSize[:]))
1481         }
1482
1483         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
1484         if err != nil {
1485                 return res, err
1486         }
1487
1488         hlFile, err := newFileWrapper(cc.Server.FS, fullFilePath, dataOffset)
1489         if err != nil {
1490                 return res, err
1491         }
1492
1493         xferSize := hlFile.ffo.TransferSize(0)
1494
1495         ft := cc.newFileTransfer(FileDownload, fileName, filePath, xferSize)
1496
1497         // TODO: refactor to remove this
1498         if resumeData != nil {
1499                 var frd FileResumeData
1500                 if err := frd.UnmarshalBinary(t.GetField(FieldFileResumeData).Data); err != nil {
1501                         return res, err
1502                 }
1503                 ft.fileResumeData = &frd
1504         }
1505
1506         // Optional field for when a HL v1.5+ client requests file preview
1507         // Used only for TEXT, JPEG, GIFF, BMP or PICT files
1508         // The value will always be 2
1509         if t.GetField(FieldFileTransferOptions).Data != nil {
1510                 ft.options = t.GetField(FieldFileTransferOptions).Data
1511                 xferSize = hlFile.ffo.FlatFileDataForkHeader.DataSize[:]
1512         }
1513
1514         res = append(res, cc.NewReply(t,
1515                 NewField(FieldRefNum, ft.refNum[:]),
1516                 NewField(FieldWaitingCount, []byte{0x00, 0x00}), // TODO: Implement waiting count
1517                 NewField(FieldTransferSize, xferSize),
1518                 NewField(FieldFileSize, hlFile.ffo.FlatFileDataForkHeader.DataSize[:]),
1519         ))
1520
1521         return res, err
1522 }
1523
1524 // Download all files from the specified folder and sub-folders
1525 func HandleDownloadFolder(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1526         if !cc.Authorize(accessDownloadFile) {
1527                 res = append(res, cc.NewErrReply(t, "You are not allowed to download folders."))
1528                 return res, err
1529         }
1530
1531         fullFilePath, err := readPath(cc.Server.Config.FileRoot, t.GetField(FieldFilePath).Data, t.GetField(FieldFileName).Data)
1532         if err != nil {
1533                 return res, err
1534         }
1535
1536         transferSize, err := CalcTotalSize(fullFilePath)
1537         if err != nil {
1538                 return res, err
1539         }
1540         itemCount, err := CalcItemCount(fullFilePath)
1541         if err != nil {
1542                 return res, err
1543         }
1544
1545         fileTransfer := cc.newFileTransfer(FolderDownload, t.GetField(FieldFileName).Data, t.GetField(FieldFilePath).Data, transferSize)
1546
1547         var fp FilePath
1548         _, err = fp.Write(t.GetField(FieldFilePath).Data)
1549         if err != nil {
1550                 return res, err
1551         }
1552
1553         res = append(res, cc.NewReply(t,
1554                 NewField(FieldRefNum, fileTransfer.ReferenceNumber),
1555                 NewField(FieldTransferSize, transferSize),
1556                 NewField(FieldFolderItemCount, itemCount),
1557                 NewField(FieldWaitingCount, []byte{0x00, 0x00}), // TODO: Implement waiting count
1558         ))
1559         return res, err
1560 }
1561
1562 // Upload all files from the local folder and its subfolders to the specified path on the server
1563 // Fields used in the request
1564 // 201  File name
1565 // 202  File path
1566 // 108  transfer size   Total size of all items in the folder
1567 // 220  Folder item count
1568 // 204  File transfer options   "Optional Currently set to 1" (TODO: ??)
1569 func HandleUploadFolder(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1570         var fp FilePath
1571         if t.GetField(FieldFilePath).Data != nil {
1572                 if _, err = fp.Write(t.GetField(FieldFilePath).Data); err != nil {
1573                         return res, err
1574                 }
1575         }
1576
1577         // Handle special cases for Upload and Drop Box folders
1578         if !cc.Authorize(accessUploadAnywhere) {
1579                 if !fp.IsUploadDir() && !fp.IsDropbox() {
1580                         res = append(res, cc.NewErrReply(t, fmt.Sprintf("Cannot accept upload of the folder \"%v\" because you are only allowed to upload to the \"Uploads\" folder.", string(t.GetField(FieldFileName).Data))))
1581                         return res, err
1582                 }
1583         }
1584
1585         fileTransfer := cc.newFileTransfer(FolderUpload,
1586                 t.GetField(FieldFileName).Data,
1587                 t.GetField(FieldFilePath).Data,
1588                 t.GetField(FieldTransferSize).Data,
1589         )
1590
1591         fileTransfer.FolderItemCount = t.GetField(FieldFolderItemCount).Data
1592
1593         res = append(res, cc.NewReply(t, NewField(FieldRefNum, fileTransfer.ReferenceNumber)))
1594         return res, err
1595 }
1596
1597 // HandleUploadFile
1598 // Fields used in the request:
1599 // 201  File name
1600 // 202  File path
1601 // 204  File transfer options   "Optional
1602 // Used only to resume download, currently has value 2"
1603 // 108  File transfer size      "Optional used if download is not resumed"
1604 func HandleUploadFile(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1605         if !cc.Authorize(accessUploadFile) {
1606                 res = append(res, cc.NewErrReply(t, "You are not allowed to upload files."))
1607                 return res, err
1608         }
1609
1610         fileName := t.GetField(FieldFileName).Data
1611         filePath := t.GetField(FieldFilePath).Data
1612         transferOptions := t.GetField(FieldFileTransferOptions).Data
1613         transferSize := t.GetField(FieldTransferSize).Data // not sent for resume
1614
1615         var fp FilePath
1616         if filePath != nil {
1617                 if _, err = fp.Write(filePath); err != nil {
1618                         return res, err
1619                 }
1620         }
1621
1622         // Handle special cases for Upload and Drop Box folders
1623         if !cc.Authorize(accessUploadAnywhere) {
1624                 if !fp.IsUploadDir() && !fp.IsDropbox() {
1625                         res = append(res, cc.NewErrReply(t, fmt.Sprintf("Cannot accept upload of the file \"%v\" because you are only allowed to upload to the \"Uploads\" folder.", string(fileName))))
1626                         return res, err
1627                 }
1628         }
1629         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
1630         if err != nil {
1631                 return res, err
1632         }
1633
1634         if _, err := cc.Server.FS.Stat(fullFilePath); err == nil {
1635                 res = append(res, cc.NewErrReply(t, fmt.Sprintf("Cannot accept upload because there is already a file named \"%v\".  Try choosing a different name.", string(fileName))))
1636                 return res, err
1637         }
1638
1639         ft := cc.newFileTransfer(FileUpload, fileName, filePath, transferSize)
1640
1641         replyT := cc.NewReply(t, NewField(FieldRefNum, ft.ReferenceNumber))
1642
1643         // client has requested to resume a partially transferred file
1644         if transferOptions != nil {
1645                 fileInfo, err := cc.Server.FS.Stat(fullFilePath + incompleteFileSuffix)
1646                 if err != nil {
1647                         return res, err
1648                 }
1649
1650                 offset := make([]byte, 4)
1651                 binary.BigEndian.PutUint32(offset, uint32(fileInfo.Size()))
1652
1653                 fileResumeData := NewFileResumeData([]ForkInfoList{
1654                         *NewForkInfoList(offset),
1655                 })
1656
1657                 b, _ := fileResumeData.BinaryMarshal()
1658
1659                 ft.TransferSize = offset
1660
1661                 replyT.Fields = append(replyT.Fields, NewField(FieldFileResumeData, b))
1662         }
1663
1664         res = append(res, replyT)
1665         return res, err
1666 }
1667
1668 func HandleSetClientUserInfo(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1669         if len(t.GetField(FieldUserIconID).Data) == 4 {
1670                 cc.Icon = t.GetField(FieldUserIconID).Data[2:]
1671         } else {
1672                 cc.Icon = t.GetField(FieldUserIconID).Data
1673         }
1674         if cc.Authorize(accessAnyName) {
1675                 cc.UserName = t.GetField(FieldUserName).Data
1676         }
1677
1678         // the options field is only passed by the client versions > 1.2.3.
1679         options := t.GetField(FieldOptions).Data
1680         if options != nil {
1681                 optBitmap := big.NewInt(int64(binary.BigEndian.Uint16(options)))
1682                 flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(cc.Flags)))
1683
1684                 flagBitmap.SetBit(flagBitmap, UserFlagRefusePM, optBitmap.Bit(refusePM))
1685                 binary.BigEndian.PutUint16(cc.Flags, uint16(flagBitmap.Int64()))
1686
1687                 flagBitmap.SetBit(flagBitmap, UserFlagRefusePChat, optBitmap.Bit(refuseChat))
1688                 binary.BigEndian.PutUint16(cc.Flags, uint16(flagBitmap.Int64()))
1689
1690                 // Check auto response
1691                 if optBitmap.Bit(autoResponse) == 1 {
1692                         cc.AutoReply = t.GetField(FieldAutomaticResponse).Data
1693                 } else {
1694                         cc.AutoReply = []byte{}
1695                 }
1696         }
1697
1698         for _, c := range sortedClients(cc.Server.Clients) {
1699                 res = append(res, *NewTransaction(
1700                         TranNotifyChangeUser,
1701                         c.ID,
1702                         NewField(FieldUserID, *cc.ID),
1703                         NewField(FieldUserIconID, cc.Icon),
1704                         NewField(FieldUserFlags, cc.Flags),
1705                         NewField(FieldUserName, cc.UserName),
1706                 ))
1707         }
1708
1709         return res, err
1710 }
1711
1712 // HandleKeepAlive responds to keepalive transactions with an empty reply
1713 // * HL 1.9.2 Client sends keepalive msg every 3 minutes
1714 // * HL 1.2.3 Client doesn't send keepalives
1715 func HandleKeepAlive(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1716         res = append(res, cc.NewReply(t))
1717
1718         return res, err
1719 }
1720
1721 func HandleGetFileNameList(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1722         fullPath, err := readPath(
1723                 cc.Server.Config.FileRoot,
1724                 t.GetField(FieldFilePath).Data,
1725                 nil,
1726         )
1727         if err != nil {
1728                 return res, err
1729         }
1730
1731         var fp FilePath
1732         if t.GetField(FieldFilePath).Data != nil {
1733                 if _, err = fp.Write(t.GetField(FieldFilePath).Data); err != nil {
1734                         return res, err
1735                 }
1736         }
1737
1738         // Handle special case for drop box folders
1739         if fp.IsDropbox() && !cc.Authorize(accessViewDropBoxes) {
1740                 res = append(res, cc.NewErrReply(t, "You are not allowed to view drop boxes."))
1741                 return res, err
1742         }
1743
1744         fileNames, err := getFileNameList(fullPath, cc.Server.Config.IgnoreFiles)
1745         if err != nil {
1746                 return res, err
1747         }
1748
1749         res = append(res, cc.NewReply(t, fileNames...))
1750
1751         return res, err
1752 }
1753
1754 // =================================
1755 //     Hotline private chat flow
1756 // =================================
1757 // 1. ClientA sends TranInviteNewChat to server with user ID to invite
1758 // 2. Server creates new ChatID
1759 // 3. Server sends TranInviteToChat to invitee
1760 // 4. Server replies to ClientA with new Chat ID
1761 //
1762 // A dialog box pops up in the invitee client with options to accept or decline the invitation.
1763 // If Accepted is clicked:
1764 // 1. ClientB sends TranJoinChat with FieldChatID
1765
1766 // HandleInviteNewChat invites users to new private chat
1767 func HandleInviteNewChat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1768         if !cc.Authorize(accessOpenChat) {
1769                 res = append(res, cc.NewErrReply(t, "You are not allowed to request private chat."))
1770                 return res, err
1771         }
1772
1773         // Client to Invite
1774         targetID := t.GetField(FieldUserID).Data
1775         newChatID := cc.Server.NewPrivateChat(cc)
1776
1777         // Check if target user has "Refuse private chat" flag
1778         binary.BigEndian.Uint16(targetID)
1779         targetClient := cc.Server.Clients[binary.BigEndian.Uint16(targetID)]
1780
1781         flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(targetClient.Flags)))
1782         if flagBitmap.Bit(UserFlagRefusePChat) == 1 {
1783                 res = append(res,
1784                         *NewTransaction(
1785                                 TranServerMsg,
1786                                 cc.ID,
1787                                 NewField(FieldData, []byte(string(targetClient.UserName)+" does not accept private chats.")),
1788                                 NewField(FieldUserName, targetClient.UserName),
1789                                 NewField(FieldUserID, *targetClient.ID),
1790                                 NewField(FieldOptions, []byte{0, 2}),
1791                         ),
1792                 )
1793         } else {
1794                 res = append(res,
1795                         *NewTransaction(
1796                                 TranInviteToChat,
1797                                 &targetID,
1798                                 NewField(FieldChatID, newChatID),
1799                                 NewField(FieldUserName, cc.UserName),
1800                                 NewField(FieldUserID, *cc.ID),
1801                         ),
1802                 )
1803         }
1804
1805         res = append(res,
1806                 cc.NewReply(t,
1807                         NewField(FieldChatID, newChatID),
1808                         NewField(FieldUserName, cc.UserName),
1809                         NewField(FieldUserID, *cc.ID),
1810                         NewField(FieldUserIconID, cc.Icon),
1811                         NewField(FieldUserFlags, cc.Flags),
1812                 ),
1813         )
1814
1815         return res, err
1816 }
1817
1818 func HandleInviteToChat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1819         if !cc.Authorize(accessOpenChat) {
1820                 res = append(res, cc.NewErrReply(t, "You are not allowed to request private chat."))
1821                 return res, err
1822         }
1823
1824         // Client to Invite
1825         targetID := t.GetField(FieldUserID).Data
1826         chatID := t.GetField(FieldChatID).Data
1827
1828         res = append(res,
1829                 *NewTransaction(
1830                         TranInviteToChat,
1831                         &targetID,
1832                         NewField(FieldChatID, chatID),
1833                         NewField(FieldUserName, cc.UserName),
1834                         NewField(FieldUserID, *cc.ID),
1835                 ),
1836         )
1837         res = append(res,
1838                 cc.NewReply(
1839                         t,
1840                         NewField(FieldChatID, chatID),
1841                         NewField(FieldUserName, cc.UserName),
1842                         NewField(FieldUserID, *cc.ID),
1843                         NewField(FieldUserIconID, cc.Icon),
1844                         NewField(FieldUserFlags, cc.Flags),
1845                 ),
1846         )
1847
1848         return res, err
1849 }
1850
1851 func HandleRejectChatInvite(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1852         chatID := t.GetField(FieldChatID).Data
1853         chatInt := binary.BigEndian.Uint32(chatID)
1854
1855         privChat := cc.Server.PrivateChats[chatInt]
1856
1857         resMsg := append(cc.UserName, []byte(" declined invitation to chat")...)
1858
1859         for _, c := range sortedClients(privChat.ClientConn) {
1860                 res = append(res,
1861                         *NewTransaction(
1862                                 TranChatMsg,
1863                                 c.ID,
1864                                 NewField(FieldChatID, chatID),
1865                                 NewField(FieldData, resMsg),
1866                         ),
1867                 )
1868         }
1869
1870         return res, err
1871 }
1872
1873 // HandleJoinChat is sent from a v1.8+ Hotline client when the joins a private chat
1874 // Fields used in the reply:
1875 // * 115        Chat subject
1876 // * 300        User name with info (Optional)
1877 // * 300        (more user names with info)
1878 func HandleJoinChat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1879         chatID := t.GetField(FieldChatID).Data
1880         chatInt := binary.BigEndian.Uint32(chatID)
1881
1882         privChat := cc.Server.PrivateChats[chatInt]
1883
1884         // Send TranNotifyChatChangeUser to current members of the chat to inform of new user
1885         for _, c := range sortedClients(privChat.ClientConn) {
1886                 res = append(res,
1887                         *NewTransaction(
1888                                 TranNotifyChatChangeUser,
1889                                 c.ID,
1890                                 NewField(FieldChatID, chatID),
1891                                 NewField(FieldUserName, cc.UserName),
1892                                 NewField(FieldUserID, *cc.ID),
1893                                 NewField(FieldUserIconID, cc.Icon),
1894                                 NewField(FieldUserFlags, cc.Flags),
1895                         ),
1896                 )
1897         }
1898
1899         privChat.ClientConn[cc.uint16ID()] = cc
1900
1901         replyFields := []Field{NewField(FieldChatSubject, []byte(privChat.Subject))}
1902         for _, c := range sortedClients(privChat.ClientConn) {
1903                 user := User{
1904                         ID:    *c.ID,
1905                         Icon:  c.Icon,
1906                         Flags: c.Flags,
1907                         Name:  string(c.UserName),
1908                 }
1909
1910                 replyFields = append(replyFields, NewField(FieldUsernameWithInfo, user.Payload()))
1911         }
1912
1913         res = append(res, cc.NewReply(t, replyFields...))
1914         return res, err
1915 }
1916
1917 // HandleLeaveChat is sent from a v1.8+ Hotline client when the user exits a private chat
1918 // Fields used in the request:
1919 //   - 114      FieldChatID
1920 //
1921 // Reply is not expected.
1922 func HandleLeaveChat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1923         chatID := t.GetField(FieldChatID).Data
1924         chatInt := binary.BigEndian.Uint32(chatID)
1925
1926         privChat, ok := cc.Server.PrivateChats[chatInt]
1927         if !ok {
1928                 return res, nil
1929         }
1930
1931         delete(privChat.ClientConn, cc.uint16ID())
1932
1933         // Notify members of the private chat that the user has left
1934         for _, c := range sortedClients(privChat.ClientConn) {
1935                 res = append(res,
1936                         *NewTransaction(
1937                                 TranNotifyChatDeleteUser,
1938                                 c.ID,
1939                                 NewField(FieldChatID, chatID),
1940                                 NewField(FieldUserID, *cc.ID),
1941                         ),
1942                 )
1943         }
1944
1945         return res, err
1946 }
1947
1948 // HandleSetChatSubject is sent from a v1.8+ Hotline client when the user sets a private chat subject
1949 // Fields used in the request:
1950 // * 114        Chat ID
1951 // * 115        Chat subject
1952 // Reply is not expected.
1953 func HandleSetChatSubject(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1954         chatID := t.GetField(FieldChatID).Data
1955         chatInt := binary.BigEndian.Uint32(chatID)
1956
1957         privChat := cc.Server.PrivateChats[chatInt]
1958         privChat.Subject = string(t.GetField(FieldChatSubject).Data)
1959
1960         for _, c := range sortedClients(privChat.ClientConn) {
1961                 res = append(res,
1962                         *NewTransaction(
1963                                 TranNotifyChatSubject,
1964                                 c.ID,
1965                                 NewField(FieldChatID, chatID),
1966                                 NewField(FieldChatSubject, t.GetField(FieldChatSubject).Data),
1967                         ),
1968                 )
1969         }
1970
1971         return res, err
1972 }
1973
1974 // HandleMakeAlias makes a file alias using the specified path.
1975 // Fields used in the request:
1976 // 201  File name
1977 // 202  File path
1978 // 212  File new path   Destination path
1979 //
1980 // Fields used in the reply:
1981 // None
1982 func HandleMakeAlias(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1983         if !cc.Authorize(accessMakeAlias) {
1984                 res = append(res, cc.NewErrReply(t, "You are not allowed to make aliases."))
1985                 return res, err
1986         }
1987         fileName := t.GetField(FieldFileName).Data
1988         filePath := t.GetField(FieldFilePath).Data
1989         fileNewPath := t.GetField(FieldFileNewPath).Data
1990
1991         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
1992         if err != nil {
1993                 return res, err
1994         }
1995
1996         fullNewFilePath, err := readPath(cc.Server.Config.FileRoot, fileNewPath, fileName)
1997         if err != nil {
1998                 return res, err
1999         }
2000
2001         cc.logger.Debugw("Make alias", "src", fullFilePath, "dst", fullNewFilePath)
2002
2003         if err := cc.Server.FS.Symlink(fullFilePath, fullNewFilePath); err != nil {
2004                 res = append(res, cc.NewErrReply(t, "Error creating alias"))
2005                 return res, nil
2006         }
2007
2008         res = append(res, cc.NewReply(t))
2009         return res, err
2010 }
2011
2012 // HandleDownloadBanner handles requests for a new banner from the server
2013 // Fields used in the request:
2014 // None
2015 // Fields used in the reply:
2016 // 107  FieldRefNum                     Used later for transfer
2017 // 108  FieldTransferSize       Size of data to be downloaded
2018 func HandleDownloadBanner(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
2019         fi, err := cc.Server.FS.Stat(filepath.Join(cc.Server.ConfigDir, cc.Server.Config.BannerFile))
2020         if err != nil {
2021                 return res, err
2022         }
2023
2024         ft := cc.newFileTransfer(bannerDownload, []byte{}, []byte{}, make([]byte, 4))
2025
2026         binary.BigEndian.PutUint32(ft.TransferSize, uint32(fi.Size()))
2027
2028         res = append(res, cc.NewReply(t,
2029                 NewField(FieldRefNum, ft.refNum[:]),
2030                 NewField(FieldTransferSize, ft.TransferSize),
2031         ))
2032
2033         return res, err
2034 }