git.r.bdr.sh - rbdr/mobius/blob - hotline/transaction_handlers.go

   1 package hotline
   2
   3 import (
   4         "bufio"
   5         "bytes"
   6         "encoding/binary"
   7         "errors"
   8         "fmt"
   9         "gopkg.in/yaml.v3"
  10         "io"
  11         "math/big"
  12         "os"
  13         "path"
  14         "path/filepath"
  15         "sort"
  16         "strings"
  17         "time"
  18 )
  19
  20 type HandlerFunc func(*ClientConn, *Transaction) ([]Transaction, error)
  21
  22 type TransactionType struct {
  23         Handler        HandlerFunc // function for handling the transaction type
  24         Name           string      // Name of transaction as it will appear in logging
  25         RequiredFields []requiredField
  26 }
  27
  28 var TransactionHandlers = map[uint16]TransactionType{
  29         // Server initiated
  30         TranChatMsg: {
  31                 Name: "TranChatMsg",
  32         },
  33         // Server initiated
  34         TranNotifyChangeUser: {
  35                 Name: "TranNotifyChangeUser",
  36         },
  37         TranError: {
  38                 Name: "TranError",
  39         },
  40         TranShowAgreement: {
  41                 Name: "TranShowAgreement",
  42         },
  43         TranUserAccess: {
  44                 Name: "TranUserAccess",
  45         },
  46         TranNotifyDeleteUser: {
  47                 Name: "TranNotifyDeleteUser",
  48         },
  49         TranAgreed: {
  50                 Name:    "TranAgreed",
  51                 Handler: HandleTranAgreed,
  52         },
  53         TranChatSend: {
  54                 Name:    "TranChatSend",
  55                 Handler: HandleChatSend,
  56                 RequiredFields: []requiredField{
  57                         {
  58                                 ID:     FieldData,
  59                                 minLen: 0,
  60                         },
  61                 },
  62         },
  63         TranDelNewsArt: {
  64                 Name:    "TranDelNewsArt",
  65                 Handler: HandleDelNewsArt,
  66         },
  67         TranDelNewsItem: {
  68                 Name:    "TranDelNewsItem",
  69                 Handler: HandleDelNewsItem,
  70         },
  71         TranDeleteFile: {
  72                 Name:    "TranDeleteFile",
  73                 Handler: HandleDeleteFile,
  74         },
  75         TranDeleteUser: {
  76                 Name:    "TranDeleteUser",
  77                 Handler: HandleDeleteUser,
  78         },
  79         TranDisconnectUser: {
  80                 Name:    "TranDisconnectUser",
  81                 Handler: HandleDisconnectUser,
  82         },
  83         TranDownloadFile: {
  84                 Name:    "TranDownloadFile",
  85                 Handler: HandleDownloadFile,
  86         },
  87         TranDownloadFldr: {
  88                 Name:    "TranDownloadFldr",
  89                 Handler: HandleDownloadFolder,
  90         },
  91         TranGetClientInfoText: {
  92                 Name:    "TranGetClientInfoText",
  93                 Handler: HandleGetClientInfoText,
  94         },
  95         TranGetFileInfo: {
  96                 Name:    "TranGetFileInfo",
  97                 Handler: HandleGetFileInfo,
  98         },
  99         TranGetFileNameList: {
 100                 Name:    "TranGetFileNameList",
 101                 Handler: HandleGetFileNameList,
 102         },
 103         TranGetMsgs: {
 104                 Name:    "TranGetMsgs",
 105                 Handler: HandleGetMsgs,
 106         },
 107         TranGetNewsArtData: {
 108                 Name:    "TranGetNewsArtData",
 109                 Handler: HandleGetNewsArtData,
 110         },
 111         TranGetNewsArtNameList: {
 112                 Name:    "TranGetNewsArtNameList",
 113                 Handler: HandleGetNewsArtNameList,
 114         },
 115         TranGetNewsCatNameList: {
 116                 Name:    "TranGetNewsCatNameList",
 117                 Handler: HandleGetNewsCatNameList,
 118         },
 119         TranGetUser: {
 120                 Name:    "TranGetUser",
 121                 Handler: HandleGetUser,
 122         },
 123         TranGetUserNameList: {
 124                 Name:    "tranHandleGetUserNameList",
 125                 Handler: HandleGetUserNameList,
 126         },
 127         TranInviteNewChat: {
 128                 Name:    "TranInviteNewChat",
 129                 Handler: HandleInviteNewChat,
 130         },
 131         TranInviteToChat: {
 132                 Name:    "TranInviteToChat",
 133                 Handler: HandleInviteToChat,
 134         },
 135         TranJoinChat: {
 136                 Name:    "TranJoinChat",
 137                 Handler: HandleJoinChat,
 138         },
 139         TranKeepAlive: {
 140                 Name:    "TranKeepAlive",
 141                 Handler: HandleKeepAlive,
 142         },
 143         TranLeaveChat: {
 144                 Name:    "TranJoinChat",
 145                 Handler: HandleLeaveChat,
 146         },
 147         TranListUsers: {
 148                 Name:    "TranListUsers",
 149                 Handler: HandleListUsers,
 150         },
 151         TranMoveFile: {
 152                 Name:    "TranMoveFile",
 153                 Handler: HandleMoveFile,
 154         },
 155         TranNewFolder: {
 156                 Name:    "TranNewFolder",
 157                 Handler: HandleNewFolder,
 158         },
 159         TranNewNewsCat: {
 160                 Name:    "TranNewNewsCat",
 161                 Handler: HandleNewNewsCat,
 162         },
 163         TranNewNewsFldr: {
 164                 Name:    "TranNewNewsFldr",
 165                 Handler: HandleNewNewsFldr,
 166         },
 167         TranNewUser: {
 168                 Name:    "TranNewUser",
 169                 Handler: HandleNewUser,
 170         },
 171         TranUpdateUser: {
 172                 Name:    "TranUpdateUser",
 173                 Handler: HandleUpdateUser,
 174         },
 175         TranOldPostNews: {
 176                 Name:    "TranOldPostNews",
 177                 Handler: HandleTranOldPostNews,
 178         },
 179         TranPostNewsArt: {
 180                 Name:    "TranPostNewsArt",
 181                 Handler: HandlePostNewsArt,
 182         },
 183         TranRejectChatInvite: {
 184                 Name:    "TranRejectChatInvite",
 185                 Handler: HandleRejectChatInvite,
 186         },
 187         TranSendInstantMsg: {
 188                 Name:    "TranSendInstantMsg",
 189                 Handler: HandleSendInstantMsg,
 190                 RequiredFields: []requiredField{
 191                         {
 192                                 ID:     FieldData,
 193                                 minLen: 0,
 194                         },
 195                         {
 196                                 ID: FieldUserID,
 197                         },
 198                 },
 199         },
 200         TranSetChatSubject: {
 201                 Name:    "TranSetChatSubject",
 202                 Handler: HandleSetChatSubject,
 203         },
 204         TranMakeFileAlias: {
 205                 Name:    "TranMakeFileAlias",
 206                 Handler: HandleMakeAlias,
 207                 RequiredFields: []requiredField{
 208                         {ID: FieldFileName, minLen: 1},
 209                         {ID: FieldFilePath, minLen: 1},
 210                         {ID: FieldFileNewPath, minLen: 1},
 211                 },
 212         },
 213         TranSetClientUserInfo: {
 214                 Name:    "TranSetClientUserInfo",
 215                 Handler: HandleSetClientUserInfo,
 216         },
 217         TranSetFileInfo: {
 218                 Name:    "TranSetFileInfo",
 219                 Handler: HandleSetFileInfo,
 220         },
 221         TranSetUser: {
 222                 Name:    "TranSetUser",
 223                 Handler: HandleSetUser,
 224         },
 225         TranUploadFile: {
 226                 Name:    "TranUploadFile",
 227                 Handler: HandleUploadFile,
 228         },
 229         TranUploadFldr: {
 230                 Name:    "TranUploadFldr",
 231                 Handler: HandleUploadFolder,
 232         },
 233         TranUserBroadcast: {
 234                 Name:    "TranUserBroadcast",
 235                 Handler: HandleUserBroadcast,
 236         },
 237         TranDownloadBanner: {
 238                 Name:    "TranDownloadBanner",
 239                 Handler: HandleDownloadBanner,
 240         },
 241 }
 242
 243 func HandleChatSend(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 244         if !cc.Authorize(accessSendChat) {
 245                 res = append(res, cc.NewErrReply(t, "You are not allowed to participate in chat."))
 246                 return res, err
 247         }
 248
 249         // Truncate long usernames
 250         trunc := fmt.Sprintf("%13s", cc.UserName)
 251         formattedMsg := fmt.Sprintf("\r%.14s:  %s", trunc, t.GetField(FieldData).Data)
 252
 253         // By holding the option key, Hotline chat allows users to send /me formatted messages like:
 254         // *** Halcyon does stuff
 255         // This is indicated by the presence of the optional field FieldChatOptions set to a value of 1.
 256         // Most clients do not send this option for normal chat messages.
 257         if t.GetField(FieldChatOptions).Data != nil && bytes.Equal(t.GetField(FieldChatOptions).Data, []byte{0, 1}) {
 258                 formattedMsg = fmt.Sprintf("\r*** %s %s", cc.UserName, t.GetField(FieldData).Data)
 259         }
 260
 261         // The ChatID field is used to identify messages as belonging to a private chat.
 262         // All clients *except* Frogblast omit this field for public chat, but Frogblast sends a value of 00 00 00 00.
 263         chatID := t.GetField(FieldChatID).Data
 264         if chatID != nil && !bytes.Equal([]byte{0, 0, 0, 0}, chatID) {
 265                 chatInt := binary.BigEndian.Uint32(chatID)
 266                 privChat := cc.Server.PrivateChats[chatInt]
 267
 268                 clients := sortedClients(privChat.ClientConn)
 269
 270                 // send the message to all connected clients of the private chat
 271                 for _, c := range clients {
 272                         res = append(res, *NewTransaction(
 273                                 TranChatMsg,
 274                                 c.ID,
 275                                 NewField(FieldChatID, chatID),
 276                                 NewField(FieldData, []byte(formattedMsg)),
 277                         ))
 278                 }
 279                 return res, err
 280         }
 281
 282         for _, c := range sortedClients(cc.Server.Clients) {
 283                 // Filter out clients that do not have the read chat permission
 284                 if c.Authorize(accessReadChat) {
 285                         res = append(res, *NewTransaction(TranChatMsg, c.ID, NewField(FieldData, []byte(formattedMsg))))
 286                 }
 287         }
 288
 289         return res, err
 290 }
 291
 292 // HandleSendInstantMsg sends instant message to the user on the current server.
 293 // Fields used in the request:
 294 //
 295 //      103     User ID
 296 //      113     Options
 297 //              One of the following values:
 298 //              - User message (myOpt_UserMessage = 1)
 299 //              - Refuse message (myOpt_RefuseMessage = 2)
 300 //              - Refuse chat (myOpt_RefuseChat  = 3)
 301 //              - Automatic response (myOpt_AutomaticResponse = 4)"
 302 //      101     Data    Optional
 303 //      214     Quoting message Optional
 304 //
 305 // Fields used in the reply:
 306 // None
 307 func HandleSendInstantMsg(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 308         if !cc.Authorize(accessSendPrivMsg) {
 309                 res = append(res, cc.NewErrReply(t, "You are not allowed to send private messages."))
 310                 return res, errors.New("user is not allowed to send private messages")
 311         }
 312
 313         msg := t.GetField(FieldData)
 314         ID := t.GetField(FieldUserID)
 315
 316         reply := NewTransaction(
 317                 TranServerMsg,
 318                 &ID.Data,
 319                 NewField(FieldData, msg.Data),
 320                 NewField(FieldUserName, cc.UserName),
 321                 NewField(FieldUserID, *cc.ID),
 322                 NewField(FieldOptions, []byte{0, 1}),
 323         )
 324
 325         // Later versions of Hotline include the original message in the FieldQuotingMsg field so
 326         //  the receiving client can display both the received message and what it is in reply to
 327         if t.GetField(FieldQuotingMsg).Data != nil {
 328                 reply.Fields = append(reply.Fields, NewField(FieldQuotingMsg, t.GetField(FieldQuotingMsg).Data))
 329         }
 330
 331         id, err := byteToInt(ID.Data)
 332         if err != nil {
 333                 return res, errors.New("invalid client ID")
 334         }
 335         otherClient, ok := cc.Server.Clients[uint16(id)]
 336         if !ok {
 337                 return res, errors.New("invalid client ID")
 338         }
 339
 340         // Check if target user has "Refuse private messages" flag
 341         flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(otherClient.Flags)))
 342         if flagBitmap.Bit(UserFlagRefusePM) == 1 {
 343                 res = append(res,
 344                         *NewTransaction(
 345                                 TranServerMsg,
 346                                 cc.ID,
 347                                 NewField(FieldData, []byte(string(otherClient.UserName)+" does not accept private messages.")),
 348                                 NewField(FieldUserName, otherClient.UserName),
 349                                 NewField(FieldUserID, *otherClient.ID),
 350                                 NewField(FieldOptions, []byte{0, 2}),
 351                         ),
 352                 )
 353         } else {
 354                 res = append(res, *reply)
 355         }
 356
 357         // Respond with auto reply if other client has it enabled
 358         if len(otherClient.AutoReply) > 0 {
 359                 res = append(res,
 360                         *NewTransaction(
 361                                 TranServerMsg,
 362                                 cc.ID,
 363                                 NewField(FieldData, otherClient.AutoReply),
 364                                 NewField(FieldUserName, otherClient.UserName),
 365                                 NewField(FieldUserID, *otherClient.ID),
 366                                 NewField(FieldOptions, []byte{0, 1}),
 367                         ),
 368                 )
 369         }
 370
 371         res = append(res, cc.NewReply(t))
 372
 373         return res, err
 374 }
 375
 376 func HandleGetFileInfo(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 377         fileName := t.GetField(FieldFileName).Data
 378         filePath := t.GetField(FieldFilePath).Data
 379
 380         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
 381         if err != nil {
 382                 return res, err
 383         }
 384
 385         fw, err := newFileWrapper(cc.Server.FS, fullFilePath, 0)
 386         if err != nil {
 387                 return res, err
 388         }
 389
 390         encodedName, err := txtEncoder.String(fw.name)
 391         if err != nil {
 392                 return res, fmt.Errorf("invalid filepath encoding: %w", err)
 393         }
 394
 395         fields := []Field{
 396                 NewField(FieldFileName, []byte(encodedName)),
 397                 NewField(FieldFileTypeString, fw.ffo.FlatFileInformationFork.friendlyType()),
 398                 NewField(FieldFileCreatorString, fw.ffo.FlatFileInformationFork.friendlyCreator()),
 399                 NewField(FieldFileType, fw.ffo.FlatFileInformationFork.TypeSignature),
 400                 NewField(FieldFileCreateDate, fw.ffo.FlatFileInformationFork.CreateDate),
 401                 NewField(FieldFileModifyDate, fw.ffo.FlatFileInformationFork.ModifyDate),
 402         }
 403
 404         // Include the optional FileComment field if there is a comment.
 405         if len(fw.ffo.FlatFileInformationFork.Comment) != 0 {
 406                 fields = append(fields, NewField(FieldFileComment, fw.ffo.FlatFileInformationFork.Comment))
 407         }
 408
 409         // Include the FileSize field for files.
 410         if !bytes.Equal(fw.ffo.FlatFileInformationFork.TypeSignature, []byte{0x66, 0x6c, 0x64, 0x72}) {
 411                 fields = append(fields, NewField(FieldFileSize, fw.totalSize()))
 412         }
 413
 414         res = append(res, cc.NewReply(t, fields...))
 415         return res, err
 416 }
 417
 418 // HandleSetFileInfo updates a file or folder Name and/or comment from the Get Info window
 419 // Fields used in the request:
 420 // * 201        File Name
 421 // * 202        File path       Optional
 422 // * 211        File new Name   Optional
 423 // * 210        File comment    Optional
 424 // Fields used in the reply:    None
 425 func HandleSetFileInfo(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 426         fileName := t.GetField(FieldFileName).Data
 427         filePath := t.GetField(FieldFilePath).Data
 428
 429         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
 430         if err != nil {
 431                 return res, err
 432         }
 433
 434         fi, err := cc.Server.FS.Stat(fullFilePath)
 435         if err != nil {
 436                 return res, err
 437         }
 438
 439         hlFile, err := newFileWrapper(cc.Server.FS, fullFilePath, 0)
 440         if err != nil {
 441                 return res, err
 442         }
 443         if t.GetField(FieldFileComment).Data != nil {
 444                 switch mode := fi.Mode(); {
 445                 case mode.IsDir():
 446                         if !cc.Authorize(accessSetFolderComment) {
 447                                 res = append(res, cc.NewErrReply(t, "You are not allowed to set comments for folders."))
 448                                 return res, err
 449                         }
 450                 case mode.IsRegular():
 451                         if !cc.Authorize(accessSetFileComment) {
 452                                 res = append(res, cc.NewErrReply(t, "You are not allowed to set comments for files."))
 453                                 return res, err
 454                         }
 455                 }
 456
 457                 if err := hlFile.ffo.FlatFileInformationFork.setComment(t.GetField(FieldFileComment).Data); err != nil {
 458                         return res, err
 459                 }
 460                 w, err := hlFile.infoForkWriter()
 461                 if err != nil {
 462                         return res, err
 463                 }
 464                 _, err = io.Copy(w, &hlFile.ffo.FlatFileInformationFork)
 465                 if err != nil {
 466                         return res, err
 467                 }
 468         }
 469
 470         fullNewFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, t.GetField(FieldFileNewName).Data)
 471         if err != nil {
 472                 return nil, err
 473         }
 474
 475         fileNewName := t.GetField(FieldFileNewName).Data
 476
 477         if fileNewName != nil {
 478                 switch mode := fi.Mode(); {
 479                 case mode.IsDir():
 480                         if !cc.Authorize(accessRenameFolder) {
 481                                 res = append(res, cc.NewErrReply(t, "You are not allowed to rename folders."))
 482                                 return res, err
 483                         }
 484                         err = os.Rename(fullFilePath, fullNewFilePath)
 485                         if os.IsNotExist(err) {
 486                                 res = append(res, cc.NewErrReply(t, "Cannot rename folder "+string(fileName)+" because it does not exist or cannot be found."))
 487                                 return res, err
 488                         }
 489                 case mode.IsRegular():
 490                         if !cc.Authorize(accessRenameFile) {
 491                                 res = append(res, cc.NewErrReply(t, "You are not allowed to rename files."))
 492                                 return res, err
 493                         }
 494                         fileDir, err := readPath(cc.Server.Config.FileRoot, filePath, []byte{})
 495                         if err != nil {
 496                                 return nil, err
 497                         }
 498                         hlFile.name, err = txtDecoder.String(string(fileNewName))
 499                         if err != nil {
 500                                 return res, fmt.Errorf("invalid filepath encoding: %w", err)
 501                         }
 502
 503                         err = hlFile.move(fileDir)
 504                         if os.IsNotExist(err) {
 505                                 res = append(res, cc.NewErrReply(t, "Cannot rename file "+string(fileName)+" because it does not exist or cannot be found."))
 506                                 return res, err
 507                         }
 508                         if err != nil {
 509                                 return res, err
 510                         }
 511                 }
 512         }
 513
 514         res = append(res, cc.NewReply(t))
 515         return res, err
 516 }
 517
 518 // HandleDeleteFile deletes a file or folder
 519 // Fields used in the request:
 520 // * 201        File Name
 521 // * 202        File path
 522 // Fields used in the reply: none
 523 func HandleDeleteFile(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 524         fileName := t.GetField(FieldFileName).Data
 525         filePath := t.GetField(FieldFilePath).Data
 526
 527         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
 528         if err != nil {
 529                 return res, err
 530         }
 531
 532         hlFile, err := newFileWrapper(cc.Server.FS, fullFilePath, 0)
 533         if err != nil {
 534                 return res, err
 535         }
 536
 537         fi, err := hlFile.dataFile()
 538         if err != nil {
 539                 res = append(res, cc.NewErrReply(t, "Cannot delete file "+string(fileName)+" because it does not exist or cannot be found."))
 540                 return res, nil
 541         }
 542
 543         switch mode := fi.Mode(); {
 544         case mode.IsDir():
 545                 if !cc.Authorize(accessDeleteFolder) {
 546                         res = append(res, cc.NewErrReply(t, "You are not allowed to delete folders."))
 547                         return res, err
 548                 }
 549         case mode.IsRegular():
 550                 if !cc.Authorize(accessDeleteFile) {
 551                         res = append(res, cc.NewErrReply(t, "You are not allowed to delete files."))
 552                         return res, err
 553                 }
 554         }
 555
 556         if err := hlFile.delete(); err != nil {
 557                 return res, err
 558         }
 559
 560         res = append(res, cc.NewReply(t))
 561         return res, err
 562 }
 563
 564 // HandleMoveFile moves files or folders. Note: seemingly not documented
 565 func HandleMoveFile(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 566         fileName := string(t.GetField(FieldFileName).Data)
 567
 568         filePath, err := readPath(cc.Server.Config.FileRoot, t.GetField(FieldFilePath).Data, t.GetField(FieldFileName).Data)
 569         if err != nil {
 570                 return res, err
 571         }
 572
 573         fileNewPath, err := readPath(cc.Server.Config.FileRoot, t.GetField(FieldFileNewPath).Data, nil)
 574         if err != nil {
 575                 return res, err
 576         }
 577
 578         cc.logger.Info("Move file", "src", filePath+"/"+fileName, "dst", fileNewPath+"/"+fileName)
 579
 580         hlFile, err := newFileWrapper(cc.Server.FS, filePath, 0)
 581         if err != nil {
 582                 return res, err
 583         }
 584
 585         fi, err := hlFile.dataFile()
 586         if err != nil {
 587                 res = append(res, cc.NewErrReply(t, "Cannot delete file "+fileName+" because it does not exist or cannot be found."))
 588                 return res, err
 589         }
 590         switch mode := fi.Mode(); {
 591         case mode.IsDir():
 592                 if !cc.Authorize(accessMoveFolder) {
 593                         res = append(res, cc.NewErrReply(t, "You are not allowed to move folders."))
 594                         return res, err
 595                 }
 596         case mode.IsRegular():
 597                 if !cc.Authorize(accessMoveFile) {
 598                         res = append(res, cc.NewErrReply(t, "You are not allowed to move files."))
 599                         return res, err
 600                 }
 601         }
 602         if err := hlFile.move(fileNewPath); err != nil {
 603                 return res, err
 604         }
 605         // TODO: handle other possible errors; e.g. fileWrapper delete fails due to fileWrapper permission issue
 606
 607         res = append(res, cc.NewReply(t))
 608         return res, err
 609 }
 610
 611 func HandleNewFolder(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 612         if !cc.Authorize(accessCreateFolder) {
 613                 res = append(res, cc.NewErrReply(t, "You are not allowed to create folders."))
 614                 return res, err
 615         }
 616         folderName := string(t.GetField(FieldFileName).Data)
 617
 618         folderName = path.Join("/", folderName)
 619
 620         var subPath string
 621
 622         // FieldFilePath is only present for nested paths
 623         if t.GetField(FieldFilePath).Data != nil {
 624                 var newFp FilePath
 625                 _, err := newFp.Write(t.GetField(FieldFilePath).Data)
 626                 if err != nil {
 627                         return nil, err
 628                 }
 629
 630                 for _, pathItem := range newFp.Items {
 631                         subPath = filepath.Join("/", subPath, string(pathItem.Name))
 632                 }
 633         }
 634         newFolderPath := path.Join(cc.Server.Config.FileRoot, subPath, folderName)
 635         newFolderPath, err = txtDecoder.String(newFolderPath)
 636         if err != nil {
 637                 return res, fmt.Errorf("invalid filepath encoding: %w", err)
 638         }
 639
 640         // TODO: check path and folder Name lengths
 641
 642         if _, err := cc.Server.FS.Stat(newFolderPath); !os.IsNotExist(err) {
 643                 msg := fmt.Sprintf("Cannot create folder \"%s\" because there is already a file or folder with that Name.", folderName)
 644                 return []Transaction{cc.NewErrReply(t, msg)}, nil
 645         }
 646
 647         if err := cc.Server.FS.Mkdir(newFolderPath, 0777); err != nil {
 648                 msg := fmt.Sprintf("Cannot create folder \"%s\" because an error occurred.", folderName)
 649                 return []Transaction{cc.NewErrReply(t, msg)}, nil
 650         }
 651
 652         res = append(res, cc.NewReply(t))
 653         return res, err
 654 }
 655
 656 func HandleSetUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 657         if !cc.Authorize(accessModifyUser) {
 658                 res = append(res, cc.NewErrReply(t, "You are not allowed to modify accounts."))
 659                 return res, err
 660         }
 661
 662         login := string(encodeString(t.GetField(FieldUserLogin).Data))
 663         userName := string(t.GetField(FieldUserName).Data)
 664
 665         newAccessLvl := t.GetField(FieldUserAccess).Data
 666
 667         account := cc.Server.Accounts[login]
 668         if account == nil {
 669                 return append(res, cc.NewErrReply(t, "Account not found.")), nil
 670         }
 671         account.Name = userName
 672         copy(account.Access[:], newAccessLvl)
 673
 674         // If the password field is cleared in the Hotline edit user UI, the SetUser transaction does
 675         // not include FieldUserPassword
 676         if t.GetField(FieldUserPassword).Data == nil {
 677                 account.Password = hashAndSalt([]byte(""))
 678         }
 679
 680         if !bytes.Equal([]byte{0}, t.GetField(FieldUserPassword).Data) {
 681                 account.Password = hashAndSalt(t.GetField(FieldUserPassword).Data)
 682         }
 683
 684         out, err := yaml.Marshal(&account)
 685         if err != nil {
 686                 return res, err
 687         }
 688         if err := os.WriteFile(filepath.Join(cc.Server.ConfigDir, "Users", login+".yaml"), out, 0666); err != nil {
 689                 return res, err
 690         }
 691
 692         // Notify connected clients logged in as the user of the new access level
 693         for _, c := range cc.Server.Clients {
 694                 if c.Account.Login == login {
 695                         // Note: comment out these two lines to test server-side deny messages
 696                         newT := NewTransaction(TranUserAccess, c.ID, NewField(FieldUserAccess, newAccessLvl))
 697                         res = append(res, *newT)
 698
 699                         flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(c.Flags)))
 700                         if c.Authorize(accessDisconUser) {
 701                                 flagBitmap.SetBit(flagBitmap, UserFlagAdmin, 1)
 702                         } else {
 703                                 flagBitmap.SetBit(flagBitmap, UserFlagAdmin, 0)
 704                         }
 705                         binary.BigEndian.PutUint16(c.Flags, uint16(flagBitmap.Int64()))
 706
 707                         c.Account.Access = account.Access
 708
 709                         cc.sendAll(
 710                                 TranNotifyChangeUser,
 711                                 NewField(FieldUserID, *c.ID),
 712                                 NewField(FieldUserFlags, c.Flags),
 713                                 NewField(FieldUserName, c.UserName),
 714                                 NewField(FieldUserIconID, c.Icon),
 715                         )
 716                 }
 717         }
 718
 719         res = append(res, cc.NewReply(t))
 720         return res, err
 721 }
 722
 723 func HandleGetUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 724         if !cc.Authorize(accessOpenUser) {
 725                 res = append(res, cc.NewErrReply(t, "You are not allowed to view accounts."))
 726                 return res, err
 727         }
 728
 729         account := cc.Server.Accounts[string(t.GetField(FieldUserLogin).Data)]
 730         if account == nil {
 731                 res = append(res, cc.NewErrReply(t, "Account does not exist."))
 732                 return res, err
 733         }
 734
 735         res = append(res, cc.NewReply(t,
 736                 NewField(FieldUserName, []byte(account.Name)),
 737                 NewField(FieldUserLogin, encodeString(t.GetField(FieldUserLogin).Data)),
 738                 NewField(FieldUserPassword, []byte(account.Password)),
 739                 NewField(FieldUserAccess, account.Access[:]),
 740         ))
 741         return res, err
 742 }
 743
 744 func HandleListUsers(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 745         if !cc.Authorize(accessOpenUser) {
 746                 res = append(res, cc.NewErrReply(t, "You are not allowed to view accounts."))
 747                 return res, err
 748         }
 749
 750         var userFields []Field
 751         for _, acc := range cc.Server.Accounts {
 752                 accCopy := *acc
 753                 b, err := io.ReadAll(&accCopy)
 754                 if err != nil {
 755                         return res, err
 756                 }
 757
 758                 userFields = append(userFields, NewField(FieldData, b))
 759         }
 760
 761         res = append(res, cc.NewReply(t, userFields...))
 762         return res, err
 763 }
 764
 765 // HandleUpdateUser is used by the v1.5+ multi-user editor to perform account editing for multiple users at a time.
 766 // An update can be a mix of these actions:
 767 // * Create user
 768 // * Delete user
 769 // * Modify user (including renaming the account login)
 770 //
 771 // The Transaction sent by the client includes one data field per user that was modified.  This data field in turn
 772 // contains another data field encoded in its payload with a varying number of sub fields depending on which action is
 773 // performed.  This seems to be the only place in the Hotline protocol where a data field contains another data field.
 774 func HandleUpdateUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 775         for _, field := range t.Fields {
 776
 777                 var subFields []Field
 778
 779                 // Create a new scanner for parsing incoming bytes into transaction tokens
 780                 scanner := bufio.NewScanner(bytes.NewReader(field.Data[2:]))
 781                 scanner.Split(fieldScanner)
 782
 783                 for i := 0; i < int(binary.BigEndian.Uint16(field.Data[0:2])); i++ {
 784                         scanner.Scan()
 785
 786                         var field Field
 787                         if _, err := field.Write(scanner.Bytes()); err != nil {
 788                                 return res, fmt.Errorf("error reading field: %w", err)
 789                         }
 790                         subFields = append(subFields, field)
 791                 }
 792
 793                 // If there's only one subfield, that indicates this is a delete operation for the login in FieldData
 794                 if len(subFields) == 1 {
 795                         if !cc.Authorize(accessDeleteUser) {
 796                                 res = append(res, cc.NewErrReply(t, "You are not allowed to delete accounts."))
 797                                 return res, err
 798                         }
 799
 800                         login := string(encodeString(getField(FieldData, &subFields).Data))
 801                         cc.logger.Info("DeleteUser", "login", login)
 802
 803                         if err := cc.Server.DeleteUser(login); err != nil {
 804                                 return res, err
 805                         }
 806                         continue
 807                 }
 808
 809                 // login of the account to update
 810                 var accountToUpdate, loginToRename string
 811
 812                 // If FieldData is included, this is a rename operation where FieldData contains the login of the existing
 813                 // account and FieldUserLogin contains the new login.
 814                 if getField(FieldData, &subFields) != nil {
 815                         loginToRename = string(encodeString(getField(FieldData, &subFields).Data))
 816                 }
 817                 userLogin := string(encodeString(getField(FieldUserLogin, &subFields).Data))
 818                 if loginToRename != "" {
 819                         accountToUpdate = loginToRename
 820                 } else {
 821                         accountToUpdate = userLogin
 822                 }
 823
 824                 // Check if accountToUpdate has an existing account.  If so, we know we are updating an existing user.
 825                 if acc, ok := cc.Server.Accounts[accountToUpdate]; ok {
 826                         if loginToRename != "" {
 827                                 cc.logger.Info("RenameUser", "prevLogin", accountToUpdate, "newLogin", userLogin)
 828                         } else {
 829                                 cc.logger.Info("UpdateUser", "login", accountToUpdate)
 830                         }
 831
 832                         // account exists, so this is an update action
 833                         if !cc.Authorize(accessModifyUser) {
 834                                 res = append(res, cc.NewErrReply(t, "You are not allowed to modify accounts."))
 835                                 return res, nil
 836                         }
 837
 838                         // This part is a bit tricky. There are three possibilities:
 839                         // 1) The transaction is intended to update the password.
 840                         //        In this case, FieldUserPassword is sent with the new password.
 841                         // 2) The transaction is intended to remove the password.
 842                         //    In this case, FieldUserPassword is not sent.
 843                         // 3) The transaction updates the users access bits, but not the password.
 844                         //    In this case, FieldUserPassword is sent with zero as the only byte.
 845                         if getField(FieldUserPassword, &subFields) != nil {
 846                                 newPass := getField(FieldUserPassword, &subFields).Data
 847                                 if !bytes.Equal([]byte{0}, newPass) {
 848                                         acc.Password = hashAndSalt(newPass)
 849                                 }
 850                         } else {
 851                                 acc.Password = hashAndSalt([]byte(""))
 852                         }
 853
 854                         if getField(FieldUserAccess, &subFields) != nil {
 855                                 copy(acc.Access[:], getField(FieldUserAccess, &subFields).Data)
 856                         }
 857
 858                         err = cc.Server.UpdateUser(
 859                                 string(encodeString(getField(FieldData, &subFields).Data)),
 860                                 string(encodeString(getField(FieldUserLogin, &subFields).Data)),
 861                                 string(getField(FieldUserName, &subFields).Data),
 862                                 acc.Password,
 863                                 acc.Access,
 864                         )
 865                         if err != nil {
 866                                 return res, err
 867                         }
 868                 } else {
 869                         if !cc.Authorize(accessCreateUser) {
 870                                 res = append(res, cc.NewErrReply(t, "You are not allowed to create new accounts."))
 871                                 return res, nil
 872                         }
 873
 874                         cc.logger.Info("CreateUser", "login", userLogin)
 875
 876                         newAccess := accessBitmap{}
 877                         copy(newAccess[:], getField(FieldUserAccess, &subFields).Data)
 878
 879                         // Prevent account from creating new account with greater permission
 880                         for i := 0; i < 64; i++ {
 881                                 if newAccess.IsSet(i) {
 882                                         if !cc.Authorize(i) {
 883                                                 return append(res, cc.NewErrReply(t, "Cannot create account with more access than yourself.")), nil
 884                                         }
 885                                 }
 886                         }
 887
 888                         err = cc.Server.NewUser(userLogin, string(getField(FieldUserName, &subFields).Data), string(getField(FieldUserPassword, &subFields).Data), newAccess)
 889                         if err != nil {
 890                                 return append(res, cc.NewErrReply(t, "Cannot create account because there is already an account with that login.")), nil
 891                         }
 892                 }
 893         }
 894
 895         res = append(res, cc.NewReply(t))
 896         return res, err
 897 }
 898
 899 // HandleNewUser creates a new user account
 900 func HandleNewUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 901         if !cc.Authorize(accessCreateUser) {
 902                 res = append(res, cc.NewErrReply(t, "You are not allowed to create new accounts."))
 903                 return res, err
 904         }
 905
 906         login := string(encodeString(t.GetField(FieldUserLogin).Data))
 907
 908         // If the account already dataFile, reply with an error
 909         if _, ok := cc.Server.Accounts[login]; ok {
 910                 res = append(res, cc.NewErrReply(t, "Cannot create account "+login+" because there is already an account with that login."))
 911                 return res, err
 912         }
 913
 914         newAccess := accessBitmap{}
 915         copy(newAccess[:], t.GetField(FieldUserAccess).Data)
 916
 917         // Prevent account from creating new account with greater permission
 918         for i := 0; i < 64; i++ {
 919                 if newAccess.IsSet(i) {
 920                         if !cc.Authorize(i) {
 921                                 res = append(res, cc.NewErrReply(t, "Cannot create account with more access than yourself."))
 922                                 return res, err
 923                         }
 924                 }
 925         }
 926
 927         if err := cc.Server.NewUser(login, string(t.GetField(FieldUserName).Data), string(t.GetField(FieldUserPassword).Data), newAccess); err != nil {
 928                 res = append(res, cc.NewErrReply(t, "Cannot create account because there is already an account with that login."))
 929                 return res, err
 930         }
 931
 932         res = append(res, cc.NewReply(t))
 933         return res, err
 934 }
 935
 936 func HandleDeleteUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 937         if !cc.Authorize(accessDeleteUser) {
 938                 res = append(res, cc.NewErrReply(t, "You are not allowed to delete accounts."))
 939                 return res, nil
 940         }
 941
 942         login := string(encodeString(t.GetField(FieldUserLogin).Data))
 943
 944         if err := cc.Server.DeleteUser(login); err != nil {
 945                 return res, err
 946         }
 947
 948         res = append(res, cc.NewReply(t))
 949         return res, err
 950 }
 951
 952 // HandleUserBroadcast sends an Administrator Message to all connected clients of the server
 953 func HandleUserBroadcast(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 954         if !cc.Authorize(accessBroadcast) {
 955                 res = append(res, cc.NewErrReply(t, "You are not allowed to send broadcast messages."))
 956                 return res, err
 957         }
 958
 959         cc.sendAll(
 960                 TranServerMsg,
 961                 NewField(FieldData, t.GetField(TranGetMsgs).Data),
 962                 NewField(FieldChatOptions, []byte{0}),
 963         )
 964
 965         res = append(res, cc.NewReply(t))
 966         return res, err
 967 }
 968
 969 // HandleGetClientInfoText returns user information for the specific user.
 970 //
 971 // Fields used in the request:
 972 // 103  User ID
 973 //
 974 // Fields used in the reply:
 975 // 102  User Name
 976 // 101  Data            User info text string
 977 func HandleGetClientInfoText(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 978         if !cc.Authorize(accessGetClientInfo) {
 979                 res = append(res, cc.NewErrReply(t, "You are not allowed to get client info."))
 980                 return res, err
 981         }
 982
 983         clientID, _ := byteToInt(t.GetField(FieldUserID).Data)
 984
 985         clientConn := cc.Server.Clients[uint16(clientID)]
 986         if clientConn == nil {
 987                 return append(res, cc.NewErrReply(t, "User not found.")), err
 988         }
 989
 990         res = append(res, cc.NewReply(t,
 991                 NewField(FieldData, []byte(clientConn.String())),
 992                 NewField(FieldUserName, clientConn.UserName),
 993         ))
 994         return res, err
 995 }
 996
 997 func HandleGetUserNameList(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 998         res = append(res, cc.NewReply(t, cc.Server.connectedUsers()...))
 999
1000         return res, err
1001 }
1002
1003 func HandleTranAgreed(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1004         if t.GetField(FieldUserName).Data != nil {
1005                 if cc.Authorize(accessAnyName) {
1006                         cc.UserName = t.GetField(FieldUserName).Data
1007                 } else {
1008                         cc.UserName = []byte(cc.Account.Name)
1009                 }
1010         }
1011
1012         cc.Icon = t.GetField(FieldUserIconID).Data
1013
1014         cc.logger = cc.logger.With("Name", string(cc.UserName))
1015         cc.logger.Info("Login successful", "clientVersion", fmt.Sprintf("%v", func() int { i, _ := byteToInt(cc.Version); return i }()))
1016
1017         options := t.GetField(FieldOptions).Data
1018         optBitmap := big.NewInt(int64(binary.BigEndian.Uint16(options)))
1019
1020         flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(cc.Flags)))
1021
1022         // Check refuse private PM option
1023         if optBitmap.Bit(UserOptRefusePM) == 1 {
1024                 flagBitmap.SetBit(flagBitmap, UserFlagRefusePM, 1)
1025                 binary.BigEndian.PutUint16(cc.Flags, uint16(flagBitmap.Int64()))
1026         }
1027
1028         // Check refuse private chat option
1029         if optBitmap.Bit(UserOptRefuseChat) == 1 {
1030                 flagBitmap.SetBit(flagBitmap, UserFlagRefusePChat, 1)
1031                 binary.BigEndian.PutUint16(cc.Flags, uint16(flagBitmap.Int64()))
1032         }
1033
1034         // Check auto response
1035         if optBitmap.Bit(UserOptAutoResponse) == 1 {
1036                 cc.AutoReply = t.GetField(FieldAutomaticResponse).Data
1037         } else {
1038                 cc.AutoReply = []byte{}
1039         }
1040
1041         trans := cc.notifyOthers(
1042                 *NewTransaction(
1043                         TranNotifyChangeUser, nil,
1044                         NewField(FieldUserName, cc.UserName),
1045                         NewField(FieldUserID, *cc.ID),
1046                         NewField(FieldUserIconID, cc.Icon),
1047                         NewField(FieldUserFlags, cc.Flags),
1048                 ),
1049         )
1050         res = append(res, trans...)
1051
1052         if cc.Server.Config.BannerFile != "" {
1053                 res = append(res, *NewTransaction(TranServerBanner, cc.ID, NewField(FieldBannerType, []byte("JPEG"))))
1054         }
1055
1056         res = append(res, cc.NewReply(t))
1057
1058         return res, err
1059 }
1060
1061 // HandleTranOldPostNews updates the flat news
1062 // Fields used in this request:
1063 // 101  Data
1064 func HandleTranOldPostNews(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1065         if !cc.Authorize(accessNewsPostArt) {
1066                 res = append(res, cc.NewErrReply(t, "You are not allowed to post news."))
1067                 return res, err
1068         }
1069
1070         cc.Server.flatNewsMux.Lock()
1071         defer cc.Server.flatNewsMux.Unlock()
1072
1073         newsDateTemplate := defaultNewsDateFormat
1074         if cc.Server.Config.NewsDateFormat != "" {
1075                 newsDateTemplate = cc.Server.Config.NewsDateFormat
1076         }
1077
1078         newsTemplate := defaultNewsTemplate
1079         if cc.Server.Config.NewsDelimiter != "" {
1080                 newsTemplate = cc.Server.Config.NewsDelimiter
1081         }
1082
1083         newsPost := fmt.Sprintf(newsTemplate+"\r", cc.UserName, time.Now().Format(newsDateTemplate), t.GetField(FieldData).Data)
1084         newsPost = strings.ReplaceAll(newsPost, "\n", "\r")
1085
1086         // update news in memory
1087         cc.Server.FlatNews = append([]byte(newsPost), cc.Server.FlatNews...)
1088
1089         // update news on disk
1090         if err := cc.Server.FS.WriteFile(filepath.Join(cc.Server.ConfigDir, "MessageBoard.txt"), cc.Server.FlatNews, 0644); err != nil {
1091                 return res, err
1092         }
1093
1094         // Notify all clients of updated news
1095         cc.sendAll(
1096                 TranNewMsg,
1097                 NewField(FieldData, []byte(newsPost)),
1098         )
1099
1100         res = append(res, cc.NewReply(t))
1101         return res, err
1102 }
1103
1104 func HandleDisconnectUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1105         if !cc.Authorize(accessDisconUser) {
1106                 res = append(res, cc.NewErrReply(t, "You are not allowed to disconnect users."))
1107                 return res, err
1108         }
1109
1110         clientConn := cc.Server.Clients[binary.BigEndian.Uint16(t.GetField(FieldUserID).Data)]
1111
1112         if clientConn.Authorize(accessCannotBeDiscon) {
1113                 res = append(res, cc.NewErrReply(t, clientConn.Account.Login+" is not allowed to be disconnected."))
1114                 return res, err
1115         }
1116
1117         // If FieldOptions is set, then the client IP is banned in addition to disconnected.
1118         // 00 01 = temporary ban
1119         // 00 02 = permanent ban
1120         if t.GetField(FieldOptions).Data != nil {
1121                 switch t.GetField(FieldOptions).Data[1] {
1122                 case 1:
1123                         // send message: "You are temporarily banned on this server"
1124                         cc.logger.Info("Disconnect & temporarily ban " + string(clientConn.UserName))
1125
1126                         res = append(res, *NewTransaction(
1127                                 TranServerMsg,
1128                                 clientConn.ID,
1129                                 NewField(FieldData, []byte("You are temporarily banned on this server")),
1130                                 NewField(FieldChatOptions, []byte{0, 0}),
1131                         ))
1132
1133                         banUntil := time.Now().Add(tempBanDuration)
1134                         cc.Server.banList[strings.Split(clientConn.RemoteAddr, ":")[0]] = &banUntil
1135                 case 2:
1136                         // send message: "You are permanently banned on this server"
1137                         cc.logger.Info("Disconnect & ban " + string(clientConn.UserName))
1138
1139                         res = append(res, *NewTransaction(
1140                                 TranServerMsg,
1141                                 clientConn.ID,
1142                                 NewField(FieldData, []byte("You are permanently banned on this server")),
1143                                 NewField(FieldChatOptions, []byte{0, 0}),
1144                         ))
1145
1146                         cc.Server.banList[strings.Split(clientConn.RemoteAddr, ":")[0]] = nil
1147                 }
1148
1149                 err := cc.Server.writeBanList()
1150                 if err != nil {
1151                         return res, err
1152                 }
1153         }
1154
1155         // TODO: remove this awful hack
1156         go func() {
1157                 time.Sleep(1 * time.Second)
1158                 clientConn.Disconnect()
1159         }()
1160
1161         return append(res, cc.NewReply(t)), err
1162 }
1163
1164 // HandleGetNewsCatNameList returns a list of news categories for a path
1165 // Fields used in the request:
1166 // 325  News path       (Optional)
1167 func HandleGetNewsCatNameList(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1168         if !cc.Authorize(accessNewsReadArt) {
1169                 res = append(res, cc.NewErrReply(t, "You are not allowed to read news."))
1170                 return res, err
1171         }
1172
1173         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1174         cats := cc.Server.GetNewsCatByPath(pathStrs)
1175
1176         // To store the keys in slice in sorted order
1177         keys := make([]string, len(cats))
1178         i := 0
1179         for k := range cats {
1180                 keys[i] = k
1181                 i++
1182         }
1183         sort.Strings(keys)
1184
1185         var fieldData []Field
1186         for _, k := range keys {
1187                 cat := cats[k]
1188                 b, _ := cat.MarshalBinary()
1189                 fieldData = append(fieldData, NewField(
1190                         FieldNewsCatListData15,
1191                         b,
1192                 ))
1193         }
1194
1195         res = append(res, cc.NewReply(t, fieldData...))
1196         return res, err
1197 }
1198
1199 func HandleNewNewsCat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1200         if !cc.Authorize(accessNewsCreateCat) {
1201                 res = append(res, cc.NewErrReply(t, "You are not allowed to create news categories."))
1202                 return res, err
1203         }
1204
1205         name := string(t.GetField(FieldNewsCatName).Data)
1206         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1207
1208         cats := cc.Server.GetNewsCatByPath(pathStrs)
1209         cats[name] = NewsCategoryListData15{
1210                 Name:     name,
1211                 Type:     [2]byte{0, 3},
1212                 Articles: map[uint32]*NewsArtData{},
1213                 SubCats:  make(map[string]NewsCategoryListData15),
1214         }
1215
1216         if err := cc.Server.writeThreadedNews(); err != nil {
1217                 return res, err
1218         }
1219         res = append(res, cc.NewReply(t))
1220         return res, err
1221 }
1222
1223 // Fields used in the request:
1224 // 322  News category Name
1225 // 325  News path
1226 func HandleNewNewsFldr(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1227         if !cc.Authorize(accessNewsCreateFldr) {
1228                 res = append(res, cc.NewErrReply(t, "You are not allowed to create news folders."))
1229                 return res, err
1230         }
1231
1232         name := string(t.GetField(FieldFileName).Data)
1233         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1234
1235         cats := cc.Server.GetNewsCatByPath(pathStrs)
1236         cats[name] = NewsCategoryListData15{
1237                 Name:     name,
1238                 Type:     [2]byte{0, 2},
1239                 Articles: map[uint32]*NewsArtData{},
1240                 SubCats:  make(map[string]NewsCategoryListData15),
1241         }
1242         if err := cc.Server.writeThreadedNews(); err != nil {
1243                 return res, err
1244         }
1245         res = append(res, cc.NewReply(t))
1246         return res, err
1247 }
1248
1249 // HandleGetNewsArtData gets the list of article names at the specified news path.
1250
1251 // Fields used in the request:
1252 // 325  News path       Optional
1253
1254 // Fields used in the reply:
1255 // 321  News article list data  Optional
1256 func HandleGetNewsArtNameList(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1257         if !cc.Authorize(accessNewsReadArt) {
1258                 res = append(res, cc.NewErrReply(t, "You are not allowed to read news."))
1259                 return res, err
1260         }
1261         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1262
1263         var cat NewsCategoryListData15
1264         cats := cc.Server.ThreadedNews.Categories
1265
1266         for _, fp := range pathStrs {
1267                 cat = cats[fp]
1268                 cats = cats[fp].SubCats
1269         }
1270
1271         nald := cat.GetNewsArtListData()
1272
1273         b, err := io.ReadAll(&nald)
1274         if err != nil {
1275
1276         }
1277
1278         res = append(res, cc.NewReply(t, NewField(FieldNewsArtListData, b)))
1279         return res, err
1280 }
1281
1282 // HandleGetNewsArtData requests information about the specific news article.
1283 // Fields used in the request:
1284 //
1285 // Request fields
1286 // 325  News path
1287 // 326  News article ID
1288 // 327  News article data flavor
1289 //
1290 // Fields used in the reply:
1291 // 328  News article title
1292 // 329  News article poster
1293 // 330  News article date
1294 // 331  Previous article ID
1295 // 332  Next article ID
1296 // 335  Parent article ID
1297 // 336  First child article ID
1298 // 327  News article data flavor        "Should be “text/plain”
1299 // 333  News article data       Optional (if data flavor is “text/plain”)
1300 func HandleGetNewsArtData(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1301         if !cc.Authorize(accessNewsReadArt) {
1302                 res = append(res, cc.NewErrReply(t, "You are not allowed to read news."))
1303                 return res, err
1304         }
1305
1306         var cat NewsCategoryListData15
1307         cats := cc.Server.ThreadedNews.Categories
1308
1309         for _, fp := range ReadNewsPath(t.GetField(FieldNewsPath).Data) {
1310                 cat = cats[fp]
1311                 cats = cats[fp].SubCats
1312         }
1313
1314         // The official Hotline clients will send the article ID as 2 bytes if possible, but
1315         // some third party clients such as Frogblast and Heildrun will always send 4 bytes
1316         convertedID, err := byteToInt(t.GetField(FieldNewsArtID).Data)
1317         if err != nil {
1318                 return res, err
1319         }
1320
1321         art := cat.Articles[uint32(convertedID)]
1322         if art == nil {
1323                 res = append(res, cc.NewReply(t))
1324                 return res, err
1325         }
1326
1327         res = append(res, cc.NewReply(t,
1328                 NewField(FieldNewsArtTitle, []byte(art.Title)),
1329                 NewField(FieldNewsArtPoster, []byte(art.Poster)),
1330                 NewField(FieldNewsArtDate, art.Date[:]),
1331                 NewField(FieldNewsArtPrevArt, art.PrevArt[:]),
1332                 NewField(FieldNewsArtNextArt, art.NextArt[:]),
1333                 NewField(FieldNewsArtParentArt, art.ParentArt[:]),
1334                 NewField(FieldNewsArt1stChildArt, art.FirstChildArt[:]),
1335                 NewField(FieldNewsArtDataFlav, []byte("text/plain")),
1336                 NewField(FieldNewsArtData, []byte(art.Data)),
1337         ))
1338         return res, err
1339 }
1340
1341 // HandleDelNewsItem deletes an existing threaded news folder or category from the server.
1342 // Fields used in the request:
1343 // 325  News path
1344 // Fields used in the reply:
1345 // None
1346 func HandleDelNewsItem(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1347         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1348
1349         cats := cc.Server.ThreadedNews.Categories
1350         delName := pathStrs[len(pathStrs)-1]
1351         if len(pathStrs) > 1 {
1352                 for _, fp := range pathStrs[0 : len(pathStrs)-1] {
1353                         cats = cats[fp].SubCats
1354                 }
1355         }
1356
1357         if cats[delName].Type == [2]byte{0, 3} {
1358                 if !cc.Authorize(accessNewsDeleteCat) {
1359                         return append(res, cc.NewErrReply(t, "You are not allowed to delete news categories.")), nil
1360                 }
1361         } else {
1362                 if !cc.Authorize(accessNewsDeleteFldr) {
1363                         return append(res, cc.NewErrReply(t, "You are not allowed to delete news folders.")), nil
1364                 }
1365         }
1366
1367         delete(cats, delName)
1368
1369         if err := cc.Server.writeThreadedNews(); err != nil {
1370                 return res, err
1371         }
1372
1373         return append(res, cc.NewReply(t)), nil
1374 }
1375
1376 func HandleDelNewsArt(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1377         if !cc.Authorize(accessNewsDeleteArt) {
1378                 res = append(res, cc.NewErrReply(t, "You are not allowed to delete news articles."))
1379                 return res, err
1380         }
1381
1382         // Request Fields
1383         // 325  News path
1384         // 326  News article ID
1385         // 337  News article – recursive delete       Delete child articles (1) or not (0)
1386         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1387         ID, err := byteToInt(t.GetField(FieldNewsArtID).Data)
1388         if err != nil {
1389                 return res, err
1390         }
1391
1392         // TODO: Delete recursive
1393         cats := cc.Server.GetNewsCatByPath(pathStrs[:len(pathStrs)-1])
1394
1395         catName := pathStrs[len(pathStrs)-1]
1396         cat := cats[catName]
1397
1398         delete(cat.Articles, uint32(ID))
1399
1400         cats[catName] = cat
1401         if err := cc.Server.writeThreadedNews(); err != nil {
1402                 return res, err
1403         }
1404
1405         res = append(res, cc.NewReply(t))
1406         return res, err
1407 }
1408
1409 // Request fields
1410 // 325  News path
1411 // 326  News article ID                                                 ID of the parent article?
1412 // 328  News article title
1413 // 334  News article flags
1414 // 327  News article data flavor                Currently “text/plain”
1415 // 333  News article data
1416 func HandlePostNewsArt(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1417         if !cc.Authorize(accessNewsPostArt) {
1418                 res = append(res, cc.NewErrReply(t, "You are not allowed to post news articles."))
1419                 return res, err
1420         }
1421
1422         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1423         cats := cc.Server.GetNewsCatByPath(pathStrs[:len(pathStrs)-1])
1424
1425         catName := pathStrs[len(pathStrs)-1]
1426         cat := cats[catName]
1427
1428         artID, err := byteToInt(t.GetField(FieldNewsArtID).Data)
1429         if err != nil {
1430                 return res, err
1431         }
1432         convertedArtID := uint32(artID)
1433         bs := make([]byte, 4)
1434         binary.BigEndian.PutUint32(bs, convertedArtID)
1435
1436         cc.Server.mux.Lock()
1437         defer cc.Server.mux.Unlock()
1438
1439         newArt := NewsArtData{
1440                 Title:         string(t.GetField(FieldNewsArtTitle).Data),
1441                 Poster:        string(cc.UserName),
1442                 Date:          toHotlineTime(time.Now()),
1443                 PrevArt:       [4]byte{},
1444                 NextArt:       [4]byte{},
1445                 ParentArt:     [4]byte(bs),
1446                 FirstChildArt: [4]byte{},
1447                 DataFlav:      []byte("text/plain"),
1448                 Data:          string(t.GetField(FieldNewsArtData).Data),
1449         }
1450
1451         var keys []int
1452         for k := range cat.Articles {
1453                 keys = append(keys, int(k))
1454         }
1455
1456         nextID := uint32(1)
1457         if len(keys) > 0 {
1458                 sort.Ints(keys)
1459                 prevID := uint32(keys[len(keys)-1])
1460                 nextID = prevID + 1
1461
1462                 binary.BigEndian.PutUint32(newArt.PrevArt[:], prevID)
1463
1464                 // Set next article ID
1465                 binary.BigEndian.PutUint32(cat.Articles[prevID].NextArt[:], nextID)
1466         }
1467
1468         // Update parent article with first child reply
1469         parentID := convertedArtID
1470         if parentID != 0 {
1471                 parentArt := cat.Articles[parentID]
1472
1473                 if parentArt.FirstChildArt == [4]byte{0, 0, 0, 0} {
1474                         binary.BigEndian.PutUint32(parentArt.FirstChildArt[:], nextID)
1475                 }
1476         }
1477
1478         cat.Articles[nextID] = &newArt
1479
1480         cats[catName] = cat
1481         if err := cc.Server.writeThreadedNews(); err != nil {
1482                 return res, err
1483         }
1484
1485         res = append(res, cc.NewReply(t))
1486         return res, err
1487 }
1488
1489 // HandleGetMsgs returns the flat news data
1490 func HandleGetMsgs(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1491         if !cc.Authorize(accessNewsReadArt) {
1492                 res = append(res, cc.NewErrReply(t, "You are not allowed to read news."))
1493                 return res, err
1494         }
1495
1496         res = append(res, cc.NewReply(t, NewField(FieldData, cc.Server.FlatNews)))
1497
1498         return res, err
1499 }
1500
1501 func HandleDownloadFile(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1502         if !cc.Authorize(accessDownloadFile) {
1503                 res = append(res, cc.NewErrReply(t, "You are not allowed to download files."))
1504                 return res, err
1505         }
1506
1507         fileName := t.GetField(FieldFileName).Data
1508         filePath := t.GetField(FieldFilePath).Data
1509         resumeData := t.GetField(FieldFileResumeData).Data
1510
1511         var dataOffset int64
1512         var frd FileResumeData
1513         if resumeData != nil {
1514                 if err := frd.UnmarshalBinary(t.GetField(FieldFileResumeData).Data); err != nil {
1515                         return res, err
1516                 }
1517                 // TODO: handle rsrc fork offset
1518                 dataOffset = int64(binary.BigEndian.Uint32(frd.ForkInfoList[0].DataSize[:]))
1519         }
1520
1521         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
1522         if err != nil {
1523                 return res, err
1524         }
1525
1526         hlFile, err := newFileWrapper(cc.Server.FS, fullFilePath, dataOffset)
1527         if err != nil {
1528                 return res, err
1529         }
1530
1531         xferSize := hlFile.ffo.TransferSize(0)
1532
1533         ft := cc.newFileTransfer(FileDownload, fileName, filePath, xferSize)
1534
1535         // TODO: refactor to remove this
1536         if resumeData != nil {
1537                 var frd FileResumeData
1538                 if err := frd.UnmarshalBinary(t.GetField(FieldFileResumeData).Data); err != nil {
1539                         return res, err
1540                 }
1541                 ft.fileResumeData = &frd
1542         }
1543
1544         // Optional field for when a HL v1.5+ client requests file preview
1545         // Used only for TEXT, JPEG, GIFF, BMP or PICT files
1546         // The value will always be 2
1547         if t.GetField(FieldFileTransferOptions).Data != nil {
1548                 ft.options = t.GetField(FieldFileTransferOptions).Data
1549                 xferSize = hlFile.ffo.FlatFileDataForkHeader.DataSize[:]
1550         }
1551
1552         res = append(res, cc.NewReply(t,
1553                 NewField(FieldRefNum, ft.refNum[:]),
1554                 NewField(FieldWaitingCount, []byte{0x00, 0x00}), // TODO: Implement waiting count
1555                 NewField(FieldTransferSize, xferSize),
1556                 NewField(FieldFileSize, hlFile.ffo.FlatFileDataForkHeader.DataSize[:]),
1557         ))
1558
1559         return res, err
1560 }
1561
1562 // Download all files from the specified folder and sub-folders
1563 func HandleDownloadFolder(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1564         if !cc.Authorize(accessDownloadFile) {
1565                 res = append(res, cc.NewErrReply(t, "You are not allowed to download folders."))
1566                 return res, err
1567         }
1568
1569         fullFilePath, err := readPath(cc.Server.Config.FileRoot, t.GetField(FieldFilePath).Data, t.GetField(FieldFileName).Data)
1570         if err != nil {
1571                 return res, err
1572         }
1573
1574         transferSize, err := CalcTotalSize(fullFilePath)
1575         if err != nil {
1576                 return res, err
1577         }
1578         itemCount, err := CalcItemCount(fullFilePath)
1579         if err != nil {
1580                 return res, err
1581         }
1582
1583         fileTransfer := cc.newFileTransfer(FolderDownload, t.GetField(FieldFileName).Data, t.GetField(FieldFilePath).Data, transferSize)
1584
1585         var fp FilePath
1586         _, err = fp.Write(t.GetField(FieldFilePath).Data)
1587         if err != nil {
1588                 return res, err
1589         }
1590
1591         res = append(res, cc.NewReply(t,
1592                 NewField(FieldRefNum, fileTransfer.ReferenceNumber),
1593                 NewField(FieldTransferSize, transferSize),
1594                 NewField(FieldFolderItemCount, itemCount),
1595                 NewField(FieldWaitingCount, []byte{0x00, 0x00}), // TODO: Implement waiting count
1596         ))
1597         return res, err
1598 }
1599
1600 // Upload all files from the local folder and its subfolders to the specified path on the server
1601 // Fields used in the request
1602 // 201  File Name
1603 // 202  File path
1604 // 108  transfer size   Total size of all items in the folder
1605 // 220  Folder item count
1606 // 204  File transfer options   "Optional Currently set to 1" (TODO: ??)
1607 func HandleUploadFolder(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1608         var fp FilePath
1609         if t.GetField(FieldFilePath).Data != nil {
1610                 if _, err = fp.Write(t.GetField(FieldFilePath).Data); err != nil {
1611                         return res, err
1612                 }
1613         }
1614
1615         // Handle special cases for Upload and Drop Box folders
1616         if !cc.Authorize(accessUploadAnywhere) {
1617                 if !fp.IsUploadDir() && !fp.IsDropbox() {
1618                         res = append(res, cc.NewErrReply(t, fmt.Sprintf("Cannot accept upload of the folder \"%v\" because you are only allowed to upload to the \"Uploads\" folder.", string(t.GetField(FieldFileName).Data))))
1619                         return res, err
1620                 }
1621         }
1622
1623         fileTransfer := cc.newFileTransfer(FolderUpload,
1624                 t.GetField(FieldFileName).Data,
1625                 t.GetField(FieldFilePath).Data,
1626                 t.GetField(FieldTransferSize).Data,
1627         )
1628
1629         fileTransfer.FolderItemCount = t.GetField(FieldFolderItemCount).Data
1630
1631         res = append(res, cc.NewReply(t, NewField(FieldRefNum, fileTransfer.ReferenceNumber)))
1632         return res, err
1633 }
1634
1635 // HandleUploadFile
1636 // Fields used in the request:
1637 // 201  File Name
1638 // 202  File path
1639 // 204  File transfer options   "Optional
1640 // Used only to resume download, currently has value 2"
1641 // 108  File transfer size      "Optional used if download is not resumed"
1642 func HandleUploadFile(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1643         if !cc.Authorize(accessUploadFile) {
1644                 res = append(res, cc.NewErrReply(t, "You are not allowed to upload files."))
1645                 return res, err
1646         }
1647
1648         fileName := t.GetField(FieldFileName).Data
1649         filePath := t.GetField(FieldFilePath).Data
1650         transferOptions := t.GetField(FieldFileTransferOptions).Data
1651         transferSize := t.GetField(FieldTransferSize).Data // not sent for resume
1652
1653         var fp FilePath
1654         if filePath != nil {
1655                 if _, err = fp.Write(filePath); err != nil {
1656                         return res, err
1657                 }
1658         }
1659
1660         // Handle special cases for Upload and Drop Box folders
1661         if !cc.Authorize(accessUploadAnywhere) {
1662                 if !fp.IsUploadDir() && !fp.IsDropbox() {
1663                         res = append(res, cc.NewErrReply(t, fmt.Sprintf("Cannot accept upload of the file \"%v\" because you are only allowed to upload to the \"Uploads\" folder.", string(fileName))))
1664                         return res, err
1665                 }
1666         }
1667         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
1668         if err != nil {
1669                 return res, err
1670         }
1671
1672         if _, err := cc.Server.FS.Stat(fullFilePath); err == nil {
1673                 res = append(res, cc.NewErrReply(t, fmt.Sprintf("Cannot accept upload because there is already a file named \"%v\".  Try choosing a different Name.", string(fileName))))
1674                 return res, err
1675         }
1676
1677         ft := cc.newFileTransfer(FileUpload, fileName, filePath, transferSize)
1678
1679         replyT := cc.NewReply(t, NewField(FieldRefNum, ft.ReferenceNumber))
1680
1681         // client has requested to resume a partially transferred file
1682         if transferOptions != nil {
1683                 fileInfo, err := cc.Server.FS.Stat(fullFilePath + incompleteFileSuffix)
1684                 if err != nil {
1685                         return res, err
1686                 }
1687
1688                 offset := make([]byte, 4)
1689                 binary.BigEndian.PutUint32(offset, uint32(fileInfo.Size()))
1690
1691                 fileResumeData := NewFileResumeData([]ForkInfoList{
1692                         *NewForkInfoList(offset),
1693                 })
1694
1695                 b, _ := fileResumeData.BinaryMarshal()
1696
1697                 ft.TransferSize = offset
1698
1699                 replyT.Fields = append(replyT.Fields, NewField(FieldFileResumeData, b))
1700         }
1701
1702         res = append(res, replyT)
1703         return res, err
1704 }
1705
1706 func HandleSetClientUserInfo(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1707         if len(t.GetField(FieldUserIconID).Data) == 4 {
1708                 cc.Icon = t.GetField(FieldUserIconID).Data[2:]
1709         } else {
1710                 cc.Icon = t.GetField(FieldUserIconID).Data
1711         }
1712         if cc.Authorize(accessAnyName) {
1713                 cc.UserName = t.GetField(FieldUserName).Data
1714         }
1715
1716         // the options field is only passed by the client versions > 1.2.3.
1717         options := t.GetField(FieldOptions).Data
1718         if options != nil {
1719                 optBitmap := big.NewInt(int64(binary.BigEndian.Uint16(options)))
1720                 flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(cc.Flags)))
1721
1722                 flagBitmap.SetBit(flagBitmap, UserFlagRefusePM, optBitmap.Bit(UserOptRefusePM))
1723                 binary.BigEndian.PutUint16(cc.Flags, uint16(flagBitmap.Int64()))
1724
1725                 flagBitmap.SetBit(flagBitmap, UserFlagRefusePChat, optBitmap.Bit(UserOptRefuseChat))
1726                 binary.BigEndian.PutUint16(cc.Flags, uint16(flagBitmap.Int64()))
1727
1728                 // Check auto response
1729                 if optBitmap.Bit(UserOptAutoResponse) == 1 {
1730                         cc.AutoReply = t.GetField(FieldAutomaticResponse).Data
1731                 } else {
1732                         cc.AutoReply = []byte{}
1733                 }
1734         }
1735
1736         for _, c := range sortedClients(cc.Server.Clients) {
1737                 res = append(res, *NewTransaction(
1738                         TranNotifyChangeUser,
1739                         c.ID,
1740                         NewField(FieldUserID, *cc.ID),
1741                         NewField(FieldUserIconID, cc.Icon),
1742                         NewField(FieldUserFlags, cc.Flags),
1743                         NewField(FieldUserName, cc.UserName),
1744                 ))
1745         }
1746
1747         return res, err
1748 }
1749
1750 // HandleKeepAlive responds to keepalive transactions with an empty reply
1751 // * HL 1.9.2 Client sends keepalive msg every 3 minutes
1752 // * HL 1.2.3 Client doesn't send keepalives
1753 func HandleKeepAlive(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1754         res = append(res, cc.NewReply(t))
1755
1756         return res, err
1757 }
1758
1759 func HandleGetFileNameList(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1760         fullPath, err := readPath(
1761                 cc.Server.Config.FileRoot,
1762                 t.GetField(FieldFilePath).Data,
1763                 nil,
1764         )
1765         if err != nil {
1766                 return res, fmt.Errorf("error reading file path: %w", err)
1767         }
1768
1769         var fp FilePath
1770         if t.GetField(FieldFilePath).Data != nil {
1771                 if _, err = fp.Write(t.GetField(FieldFilePath).Data); err != nil {
1772                         return res, fmt.Errorf("error writing file path: %w", err)
1773                 }
1774         }
1775
1776         // Handle special case for drop box folders
1777         if fp.IsDropbox() && !cc.Authorize(accessViewDropBoxes) {
1778                 res = append(res, cc.NewErrReply(t, "You are not allowed to view drop boxes."))
1779                 return res, err
1780         }
1781
1782         fileNames, err := getFileNameList(fullPath, cc.Server.Config.IgnoreFiles)
1783         if err != nil {
1784                 return res, fmt.Errorf("getFileNameList: %w", err)
1785         }
1786
1787         res = append(res, cc.NewReply(t, fileNames...))
1788
1789         return res, err
1790 }
1791
1792 // =================================
1793 //     Hotline private chat flow
1794 // =================================
1795 // 1. ClientA sends TranInviteNewChat to server with user ID to invite
1796 // 2. Server creates new ChatID
1797 // 3. Server sends TranInviteToChat to invitee
1798 // 4. Server replies to ClientA with new Chat ID
1799 //
1800 // A dialog box pops up in the invitee client with options to accept or decline the invitation.
1801 // If Accepted is clicked:
1802 // 1. ClientB sends TranJoinChat with FieldChatID
1803
1804 // HandleInviteNewChat invites users to new private chat
1805 func HandleInviteNewChat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1806         if !cc.Authorize(accessOpenChat) {
1807                 res = append(res, cc.NewErrReply(t, "You are not allowed to request private chat."))
1808                 return res, err
1809         }
1810
1811         // Client to Invite
1812         targetID := t.GetField(FieldUserID).Data
1813         newChatID := cc.Server.NewPrivateChat(cc)
1814
1815         // Check if target user has "Refuse private chat" flag
1816         binary.BigEndian.Uint16(targetID)
1817         targetClient := cc.Server.Clients[binary.BigEndian.Uint16(targetID)]
1818
1819         flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(targetClient.Flags)))
1820         if flagBitmap.Bit(UserFlagRefusePChat) == 1 {
1821                 res = append(res,
1822                         *NewTransaction(
1823                                 TranServerMsg,
1824                                 cc.ID,
1825                                 NewField(FieldData, []byte(string(targetClient.UserName)+" does not accept private chats.")),
1826                                 NewField(FieldUserName, targetClient.UserName),
1827                                 NewField(FieldUserID, *targetClient.ID),
1828                                 NewField(FieldOptions, []byte{0, 2}),
1829                         ),
1830                 )
1831         } else {
1832                 res = append(res,
1833                         *NewTransaction(
1834                                 TranInviteToChat,
1835                                 &targetID,
1836                                 NewField(FieldChatID, newChatID),
1837                                 NewField(FieldUserName, cc.UserName),
1838                                 NewField(FieldUserID, *cc.ID),
1839                         ),
1840                 )
1841         }
1842
1843         res = append(res,
1844                 cc.NewReply(t,
1845                         NewField(FieldChatID, newChatID),
1846                         NewField(FieldUserName, cc.UserName),
1847                         NewField(FieldUserID, *cc.ID),
1848                         NewField(FieldUserIconID, cc.Icon),
1849                         NewField(FieldUserFlags, cc.Flags),
1850                 ),
1851         )
1852
1853         return res, err
1854 }
1855
1856 func HandleInviteToChat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1857         if !cc.Authorize(accessOpenChat) {
1858                 res = append(res, cc.NewErrReply(t, "You are not allowed to request private chat."))
1859                 return res, err
1860         }
1861
1862         // Client to Invite
1863         targetID := t.GetField(FieldUserID).Data
1864         chatID := t.GetField(FieldChatID).Data
1865
1866         res = append(res,
1867                 *NewTransaction(
1868                         TranInviteToChat,
1869                         &targetID,
1870                         NewField(FieldChatID, chatID),
1871                         NewField(FieldUserName, cc.UserName),
1872                         NewField(FieldUserID, *cc.ID),
1873                 ),
1874         )
1875         res = append(res,
1876                 cc.NewReply(
1877                         t,
1878                         NewField(FieldChatID, chatID),
1879                         NewField(FieldUserName, cc.UserName),
1880                         NewField(FieldUserID, *cc.ID),
1881                         NewField(FieldUserIconID, cc.Icon),
1882                         NewField(FieldUserFlags, cc.Flags),
1883                 ),
1884         )
1885
1886         return res, err
1887 }
1888
1889 func HandleRejectChatInvite(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1890         chatID := t.GetField(FieldChatID).Data
1891         chatInt := binary.BigEndian.Uint32(chatID)
1892
1893         privChat := cc.Server.PrivateChats[chatInt]
1894
1895         resMsg := append(cc.UserName, []byte(" declined invitation to chat")...)
1896
1897         for _, c := range sortedClients(privChat.ClientConn) {
1898                 res = append(res,
1899                         *NewTransaction(
1900                                 TranChatMsg,
1901                                 c.ID,
1902                                 NewField(FieldChatID, chatID),
1903                                 NewField(FieldData, resMsg),
1904                         ),
1905                 )
1906         }
1907
1908         return res, err
1909 }
1910
1911 // HandleJoinChat is sent from a v1.8+ Hotline client when the joins a private chat
1912 // Fields used in the reply:
1913 // * 115        Chat subject
1914 // * 300        User Name with info (Optional)
1915 // * 300        (more user names with info)
1916 func HandleJoinChat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1917         chatID := t.GetField(FieldChatID).Data
1918         chatInt := binary.BigEndian.Uint32(chatID)
1919
1920         privChat := cc.Server.PrivateChats[chatInt]
1921
1922         // Send TranNotifyChatChangeUser to current members of the chat to inform of new user
1923         for _, c := range sortedClients(privChat.ClientConn) {
1924                 res = append(res,
1925                         *NewTransaction(
1926                                 TranNotifyChatChangeUser,
1927                                 c.ID,
1928                                 NewField(FieldChatID, chatID),
1929                                 NewField(FieldUserName, cc.UserName),
1930                                 NewField(FieldUserID, *cc.ID),
1931                                 NewField(FieldUserIconID, cc.Icon),
1932                                 NewField(FieldUserFlags, cc.Flags),
1933                         ),
1934                 )
1935         }
1936
1937         privChat.ClientConn[cc.uint16ID()] = cc
1938
1939         replyFields := []Field{NewField(FieldChatSubject, []byte(privChat.Subject))}
1940         for _, c := range sortedClients(privChat.ClientConn) {
1941
1942                 b, err := io.ReadAll(&User{
1943                         ID:    *c.ID,
1944                         Icon:  c.Icon,
1945                         Flags: c.Flags,
1946                         Name:  string(c.UserName),
1947                 })
1948                 if err != nil {
1949                         return res, nil
1950                 }
1951                 replyFields = append(replyFields, NewField(FieldUsernameWithInfo, b))
1952         }
1953
1954         res = append(res, cc.NewReply(t, replyFields...))
1955         return res, err
1956 }
1957
1958 // HandleLeaveChat is sent from a v1.8+ Hotline client when the user exits a private chat
1959 // Fields used in the request:
1960 //   - 114      FieldChatID
1961 //
1962 // Reply is not expected.
1963 func HandleLeaveChat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1964         chatID := t.GetField(FieldChatID).Data
1965         chatInt := binary.BigEndian.Uint32(chatID)
1966
1967         privChat, ok := cc.Server.PrivateChats[chatInt]
1968         if !ok {
1969                 return res, nil
1970         }
1971
1972         delete(privChat.ClientConn, cc.uint16ID())
1973
1974         // Notify members of the private chat that the user has left
1975         for _, c := range sortedClients(privChat.ClientConn) {
1976                 res = append(res,
1977                         *NewTransaction(
1978                                 TranNotifyChatDeleteUser,
1979                                 c.ID,
1980                                 NewField(FieldChatID, chatID),
1981                                 NewField(FieldUserID, *cc.ID),
1982                         ),
1983                 )
1984         }
1985
1986         return res, err
1987 }
1988
1989 // HandleSetChatSubject is sent from a v1.8+ Hotline client when the user sets a private chat subject
1990 // Fields used in the request:
1991 // * 114        Chat ID
1992 // * 115        Chat subject
1993 // Reply is not expected.
1994 func HandleSetChatSubject(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1995         chatID := t.GetField(FieldChatID).Data
1996         chatInt := binary.BigEndian.Uint32(chatID)
1997
1998         privChat := cc.Server.PrivateChats[chatInt]
1999         privChat.Subject = string(t.GetField(FieldChatSubject).Data)
2000
2001         for _, c := range sortedClients(privChat.ClientConn) {
2002                 res = append(res,
2003                         *NewTransaction(
2004                                 TranNotifyChatSubject,
2005                                 c.ID,
2006                                 NewField(FieldChatID, chatID),
2007                                 NewField(FieldChatSubject, t.GetField(FieldChatSubject).Data),
2008                         ),
2009                 )
2010         }
2011
2012         return res, err
2013 }
2014
2015 // HandleMakeAlias makes a file alias using the specified path.
2016 // Fields used in the request:
2017 // 201  File Name
2018 // 202  File path
2019 // 212  File new path   Destination path
2020 //
2021 // Fields used in the reply:
2022 // None
2023 func HandleMakeAlias(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
2024         if !cc.Authorize(accessMakeAlias) {
2025                 res = append(res, cc.NewErrReply(t, "You are not allowed to make aliases."))
2026                 return res, err
2027         }
2028         fileName := t.GetField(FieldFileName).Data
2029         filePath := t.GetField(FieldFilePath).Data
2030         fileNewPath := t.GetField(FieldFileNewPath).Data
2031
2032         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
2033         if err != nil {
2034                 return res, err
2035         }
2036
2037         fullNewFilePath, err := readPath(cc.Server.Config.FileRoot, fileNewPath, fileName)
2038         if err != nil {
2039                 return res, err
2040         }
2041
2042         cc.logger.Debug("Make alias", "src", fullFilePath, "dst", fullNewFilePath)
2043
2044         if err := cc.Server.FS.Symlink(fullFilePath, fullNewFilePath); err != nil {
2045                 res = append(res, cc.NewErrReply(t, "Error creating alias"))
2046                 return res, nil
2047         }
2048
2049         res = append(res, cc.NewReply(t))
2050         return res, err
2051 }
2052
2053 // HandleDownloadBanner handles requests for a new banner from the server
2054 // Fields used in the request:
2055 // None
2056 // Fields used in the reply:
2057 // 107  FieldRefNum                     Used later for transfer
2058 // 108  FieldTransferSize       Size of data to be downloaded
2059 func HandleDownloadBanner(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
2060         ft := cc.newFileTransfer(bannerDownload, []byte{}, []byte{}, make([]byte, 4))
2061         binary.BigEndian.PutUint32(ft.TransferSize, uint32(len(cc.Server.banner)))
2062
2063         return append(res, cc.NewReply(t,
2064                 NewField(FieldRefNum, ft.refNum[:]),
2065                 NewField(FieldTransferSize, ft.TransferSize),
2066         )), err
2067 }