git.r.bdr.sh - rbdr/mobius/blob - hotline/transaction_handlers.go

   1 package hotline
   2
   3 import (
   4         "bytes"
   5         "encoding/binary"
   6         "errors"
   7         "fmt"
   8         "gopkg.in/yaml.v3"
   9         "math/big"
  10         "os"
  11         "path"
  12         "path/filepath"
  13         "sort"
  14         "strings"
  15         "time"
  16 )
  17
  18 type HandlerFunc func(*ClientConn, *Transaction) ([]Transaction, error)
  19
  20 type TransactionType struct {
  21         Handler        HandlerFunc // function for handling the transaction type
  22         Name           string      // Name of transaction as it will appear in logging
  23         RequiredFields []requiredField
  24 }
  25
  26 var TransactionHandlers = map[uint16]TransactionType{
  27         // Server initiated
  28         TranChatMsg: {
  29                 Name: "TranChatMsg",
  30         },
  31         // Server initiated
  32         TranNotifyChangeUser: {
  33                 Name: "TranNotifyChangeUser",
  34         },
  35         TranError: {
  36                 Name: "TranError",
  37         },
  38         TranShowAgreement: {
  39                 Name: "TranShowAgreement",
  40         },
  41         TranUserAccess: {
  42                 Name: "TranUserAccess",
  43         },
  44         TranNotifyDeleteUser: {
  45                 Name: "TranNotifyDeleteUser",
  46         },
  47         TranAgreed: {
  48                 Name:    "TranAgreed",
  49                 Handler: HandleTranAgreed,
  50         },
  51         TranChatSend: {
  52                 Name:    "TranChatSend",
  53                 Handler: HandleChatSend,
  54                 RequiredFields: []requiredField{
  55                         {
  56                                 ID:     FieldData,
  57                                 minLen: 0,
  58                         },
  59                 },
  60         },
  61         TranDelNewsArt: {
  62                 Name:    "TranDelNewsArt",
  63                 Handler: HandleDelNewsArt,
  64         },
  65         TranDelNewsItem: {
  66                 Name:    "TranDelNewsItem",
  67                 Handler: HandleDelNewsItem,
  68         },
  69         TranDeleteFile: {
  70                 Name:    "TranDeleteFile",
  71                 Handler: HandleDeleteFile,
  72         },
  73         TranDeleteUser: {
  74                 Name:    "TranDeleteUser",
  75                 Handler: HandleDeleteUser,
  76         },
  77         TranDisconnectUser: {
  78                 Name:    "TranDisconnectUser",
  79                 Handler: HandleDisconnectUser,
  80         },
  81         TranDownloadFile: {
  82                 Name:    "TranDownloadFile",
  83                 Handler: HandleDownloadFile,
  84         },
  85         TranDownloadFldr: {
  86                 Name:    "TranDownloadFldr",
  87                 Handler: HandleDownloadFolder,
  88         },
  89         TranGetClientInfoText: {
  90                 Name:    "TranGetClientInfoText",
  91                 Handler: HandleGetClientInfoText,
  92         },
  93         TranGetFileInfo: {
  94                 Name:    "TranGetFileInfo",
  95                 Handler: HandleGetFileInfo,
  96         },
  97         TranGetFileNameList: {
  98                 Name:    "TranGetFileNameList",
  99                 Handler: HandleGetFileNameList,
 100         },
 101         TranGetMsgs: {
 102                 Name:    "TranGetMsgs",
 103                 Handler: HandleGetMsgs,
 104         },
 105         TranGetNewsArtData: {
 106                 Name:    "TranGetNewsArtData",
 107                 Handler: HandleGetNewsArtData,
 108         },
 109         TranGetNewsArtNameList: {
 110                 Name:    "TranGetNewsArtNameList",
 111                 Handler: HandleGetNewsArtNameList,
 112         },
 113         TranGetNewsCatNameList: {
 114                 Name:    "TranGetNewsCatNameList",
 115                 Handler: HandleGetNewsCatNameList,
 116         },
 117         TranGetUser: {
 118                 Name:    "TranGetUser",
 119                 Handler: HandleGetUser,
 120         },
 121         TranGetUserNameList: {
 122                 Name:    "tranHandleGetUserNameList",
 123                 Handler: HandleGetUserNameList,
 124         },
 125         TranInviteNewChat: {
 126                 Name:    "TranInviteNewChat",
 127                 Handler: HandleInviteNewChat,
 128         },
 129         TranInviteToChat: {
 130                 Name:    "TranInviteToChat",
 131                 Handler: HandleInviteToChat,
 132         },
 133         TranJoinChat: {
 134                 Name:    "TranJoinChat",
 135                 Handler: HandleJoinChat,
 136         },
 137         TranKeepAlive: {
 138                 Name:    "TranKeepAlive",
 139                 Handler: HandleKeepAlive,
 140         },
 141         TranLeaveChat: {
 142                 Name:    "TranJoinChat",
 143                 Handler: HandleLeaveChat,
 144         },
 145         TranListUsers: {
 146                 Name:    "TranListUsers",
 147                 Handler: HandleListUsers,
 148         },
 149         TranMoveFile: {
 150                 Name:    "TranMoveFile",
 151                 Handler: HandleMoveFile,
 152         },
 153         TranNewFolder: {
 154                 Name:    "TranNewFolder",
 155                 Handler: HandleNewFolder,
 156         },
 157         TranNewNewsCat: {
 158                 Name:    "TranNewNewsCat",
 159                 Handler: HandleNewNewsCat,
 160         },
 161         TranNewNewsFldr: {
 162                 Name:    "TranNewNewsFldr",
 163                 Handler: HandleNewNewsFldr,
 164         },
 165         TranNewUser: {
 166                 Name:    "TranNewUser",
 167                 Handler: HandleNewUser,
 168         },
 169         TranUpdateUser: {
 170                 Name:    "TranUpdateUser",
 171                 Handler: HandleUpdateUser,
 172         },
 173         TranOldPostNews: {
 174                 Name:    "TranOldPostNews",
 175                 Handler: HandleTranOldPostNews,
 176         },
 177         TranPostNewsArt: {
 178                 Name:    "TranPostNewsArt",
 179                 Handler: HandlePostNewsArt,
 180         },
 181         TranRejectChatInvite: {
 182                 Name:    "TranRejectChatInvite",
 183                 Handler: HandleRejectChatInvite,
 184         },
 185         TranSendInstantMsg: {
 186                 Name:    "TranSendInstantMsg",
 187                 Handler: HandleSendInstantMsg,
 188                 RequiredFields: []requiredField{
 189                         {
 190                                 ID:     FieldData,
 191                                 minLen: 0,
 192                         },
 193                         {
 194                                 ID: FieldUserID,
 195                         },
 196                 },
 197         },
 198         TranSetChatSubject: {
 199                 Name:    "TranSetChatSubject",
 200                 Handler: HandleSetChatSubject,
 201         },
 202         TranMakeFileAlias: {
 203                 Name:    "TranMakeFileAlias",
 204                 Handler: HandleMakeAlias,
 205                 RequiredFields: []requiredField{
 206                         {ID: FieldFileName, minLen: 1},
 207                         {ID: FieldFilePath, minLen: 1},
 208                         {ID: FieldFileNewPath, minLen: 1},
 209                 },
 210         },
 211         TranSetClientUserInfo: {
 212                 Name:    "TranSetClientUserInfo",
 213                 Handler: HandleSetClientUserInfo,
 214         },
 215         TranSetFileInfo: {
 216                 Name:    "TranSetFileInfo",
 217                 Handler: HandleSetFileInfo,
 218         },
 219         TranSetUser: {
 220                 Name:    "TranSetUser",
 221                 Handler: HandleSetUser,
 222         },
 223         TranUploadFile: {
 224                 Name:    "TranUploadFile",
 225                 Handler: HandleUploadFile,
 226         },
 227         TranUploadFldr: {
 228                 Name:    "TranUploadFldr",
 229                 Handler: HandleUploadFolder,
 230         },
 231         TranUserBroadcast: {
 232                 Name:    "TranUserBroadcast",
 233                 Handler: HandleUserBroadcast,
 234         },
 235         TranDownloadBanner: {
 236                 Name:    "TranDownloadBanner",
 237                 Handler: HandleDownloadBanner,
 238         },
 239 }
 240
 241 func HandleChatSend(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 242         if !cc.Authorize(accessSendChat) {
 243                 res = append(res, cc.NewErrReply(t, "You are not allowed to participate in chat."))
 244                 return res, err
 245         }
 246
 247         // Truncate long usernames
 248         trunc := fmt.Sprintf("%13s", cc.UserName)
 249         formattedMsg := fmt.Sprintf("\r%.14s:  %s", trunc, t.GetField(FieldData).Data)
 250
 251         // By holding the option key, Hotline chat allows users to send /me formatted messages like:
 252         // *** Halcyon does stuff
 253         // This is indicated by the presence of the optional field FieldChatOptions set to a value of 1.
 254         // Most clients do not send this option for normal chat messages.
 255         if t.GetField(FieldChatOptions).Data != nil && bytes.Equal(t.GetField(FieldChatOptions).Data, []byte{0, 1}) {
 256                 formattedMsg = fmt.Sprintf("\r*** %s %s", cc.UserName, t.GetField(FieldData).Data)
 257         }
 258
 259         // The ChatID field is used to identify messages as belonging to a private chat.
 260         // All clients *except* Frogblast omit this field for public chat, but Frogblast sends a value of 00 00 00 00.
 261         chatID := t.GetField(FieldChatID).Data
 262         if chatID != nil && !bytes.Equal([]byte{0, 0, 0, 0}, chatID) {
 263                 chatInt := binary.BigEndian.Uint32(chatID)
 264                 privChat := cc.Server.PrivateChats[chatInt]
 265
 266                 clients := sortedClients(privChat.ClientConn)
 267
 268                 // send the message to all connected clients of the private chat
 269                 for _, c := range clients {
 270                         res = append(res, *NewTransaction(
 271                                 TranChatMsg,
 272                                 c.ID,
 273                                 NewField(FieldChatID, chatID),
 274                                 NewField(FieldData, []byte(formattedMsg)),
 275                         ))
 276                 }
 277                 return res, err
 278         }
 279
 280         for _, c := range sortedClients(cc.Server.Clients) {
 281                 // Filter out clients that do not have the read chat permission
 282                 if c.Authorize(accessReadChat) {
 283                         res = append(res, *NewTransaction(TranChatMsg, c.ID, NewField(FieldData, []byte(formattedMsg))))
 284                 }
 285         }
 286
 287         return res, err
 288 }
 289
 290 // HandleSendInstantMsg sends instant message to the user on the current server.
 291 // Fields used in the request:
 292 //
 293 //      103     User ID
 294 //      113     Options
 295 //              One of the following values:
 296 //              - User message (myOpt_UserMessage = 1)
 297 //              - Refuse message (myOpt_RefuseMessage = 2)
 298 //              - Refuse chat (myOpt_RefuseChat  = 3)
 299 //              - Automatic response (myOpt_AutomaticResponse = 4)"
 300 //      101     Data    Optional
 301 //      214     Quoting message Optional
 302 //
 303 // Fields used in the reply:
 304 // None
 305 func HandleSendInstantMsg(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 306         if !cc.Authorize(accessSendPrivMsg) {
 307                 res = append(res, cc.NewErrReply(t, "You are not allowed to send private messages."))
 308                 return res, err
 309         }
 310
 311         msg := t.GetField(FieldData)
 312         ID := t.GetField(FieldUserID)
 313
 314         reply := NewTransaction(
 315                 TranServerMsg,
 316                 &ID.Data,
 317                 NewField(FieldData, msg.Data),
 318                 NewField(FieldUserName, cc.UserName),
 319                 NewField(FieldUserID, *cc.ID),
 320                 NewField(FieldOptions, []byte{0, 1}),
 321         )
 322
 323         // Later versions of Hotline include the original message in the FieldQuotingMsg field so
 324         //  the receiving client can display both the received message and what it is in reply to
 325         if t.GetField(FieldQuotingMsg).Data != nil {
 326                 reply.Fields = append(reply.Fields, NewField(FieldQuotingMsg, t.GetField(FieldQuotingMsg).Data))
 327         }
 328
 329         id, _ := byteToInt(ID.Data)
 330         otherClient, ok := cc.Server.Clients[uint16(id)]
 331         if !ok {
 332                 return res, errors.New("invalid client ID")
 333         }
 334
 335         // Check if target user has "Refuse private messages" flag
 336         flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(otherClient.Flags)))
 337         if flagBitmap.Bit(UserFlagRefusePChat) == 1 {
 338                 res = append(res,
 339                         *NewTransaction(
 340                                 TranServerMsg,
 341                                 cc.ID,
 342                                 NewField(FieldData, []byte(string(otherClient.UserName)+" does not accept private messages.")),
 343                                 NewField(FieldUserName, otherClient.UserName),
 344                                 NewField(FieldUserID, *otherClient.ID),
 345                                 NewField(FieldOptions, []byte{0, 2}),
 346                         ),
 347                 )
 348         } else {
 349                 res = append(res, *reply)
 350         }
 351
 352         // Respond with auto reply if other client has it enabled
 353         if len(otherClient.AutoReply) > 0 {
 354                 res = append(res,
 355                         *NewTransaction(
 356                                 TranServerMsg,
 357                                 cc.ID,
 358                                 NewField(FieldData, otherClient.AutoReply),
 359                                 NewField(FieldUserName, otherClient.UserName),
 360                                 NewField(FieldUserID, *otherClient.ID),
 361                                 NewField(FieldOptions, []byte{0, 1}),
 362                         ),
 363                 )
 364         }
 365
 366         res = append(res, cc.NewReply(t))
 367
 368         return res, err
 369 }
 370
 371 func HandleGetFileInfo(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 372         fileName := t.GetField(FieldFileName).Data
 373         filePath := t.GetField(FieldFilePath).Data
 374
 375         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
 376         if err != nil {
 377                 return res, err
 378         }
 379
 380         fw, err := newFileWrapper(cc.Server.FS, fullFilePath, 0)
 381         if err != nil {
 382                 return res, err
 383         }
 384
 385         res = append(res, cc.NewReply(t,
 386                 NewField(FieldFileName, []byte(fw.name)),
 387                 NewField(FieldFileTypeString, fw.ffo.FlatFileInformationFork.friendlyType()),
 388                 NewField(FieldFileCreatorString, fw.ffo.FlatFileInformationFork.friendlyCreator()),
 389                 NewField(FieldFileComment, fw.ffo.FlatFileInformationFork.Comment),
 390                 NewField(FieldFileType, fw.ffo.FlatFileInformationFork.TypeSignature),
 391                 NewField(FieldFileCreateDate, fw.ffo.FlatFileInformationFork.CreateDate),
 392                 NewField(FieldFileModifyDate, fw.ffo.FlatFileInformationFork.ModifyDate),
 393                 NewField(FieldFileSize, fw.totalSize()),
 394         ))
 395         return res, err
 396 }
 397
 398 // HandleSetFileInfo updates a file or folder name and/or comment from the Get Info window
 399 // Fields used in the request:
 400 // * 201        File name
 401 // * 202        File path       Optional
 402 // * 211        File new name   Optional
 403 // * 210        File comment    Optional
 404 // Fields used in the reply:    None
 405 func HandleSetFileInfo(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 406         fileName := t.GetField(FieldFileName).Data
 407         filePath := t.GetField(FieldFilePath).Data
 408
 409         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
 410         if err != nil {
 411                 return res, err
 412         }
 413
 414         fi, err := cc.Server.FS.Stat(fullFilePath)
 415         if err != nil {
 416                 return res, err
 417         }
 418
 419         hlFile, err := newFileWrapper(cc.Server.FS, fullFilePath, 0)
 420         if err != nil {
 421                 return res, err
 422         }
 423         if t.GetField(FieldFileComment).Data != nil {
 424                 switch mode := fi.Mode(); {
 425                 case mode.IsDir():
 426                         if !cc.Authorize(accessSetFolderComment) {
 427                                 res = append(res, cc.NewErrReply(t, "You are not allowed to set comments for folders."))
 428                                 return res, err
 429                         }
 430                 case mode.IsRegular():
 431                         if !cc.Authorize(accessSetFileComment) {
 432                                 res = append(res, cc.NewErrReply(t, "You are not allowed to set comments for files."))
 433                                 return res, err
 434                         }
 435                 }
 436
 437                 if err := hlFile.ffo.FlatFileInformationFork.setComment(t.GetField(FieldFileComment).Data); err != nil {
 438                         return res, err
 439                 }
 440                 w, err := hlFile.infoForkWriter()
 441                 if err != nil {
 442                         return res, err
 443                 }
 444                 _, err = w.Write(hlFile.ffo.FlatFileInformationFork.MarshalBinary())
 445                 if err != nil {
 446                         return res, err
 447                 }
 448         }
 449
 450         fullNewFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, t.GetField(FieldFileNewName).Data)
 451         if err != nil {
 452                 return nil, err
 453         }
 454
 455         fileNewName := t.GetField(FieldFileNewName).Data
 456
 457         if fileNewName != nil {
 458                 switch mode := fi.Mode(); {
 459                 case mode.IsDir():
 460                         if !cc.Authorize(accessRenameFolder) {
 461                                 res = append(res, cc.NewErrReply(t, "You are not allowed to rename folders."))
 462                                 return res, err
 463                         }
 464                         err = os.Rename(fullFilePath, fullNewFilePath)
 465                         if os.IsNotExist(err) {
 466                                 res = append(res, cc.NewErrReply(t, "Cannot rename folder "+string(fileName)+" because it does not exist or cannot be found."))
 467                                 return res, err
 468                         }
 469                 case mode.IsRegular():
 470                         if !cc.Authorize(accessRenameFile) {
 471                                 res = append(res, cc.NewErrReply(t, "You are not allowed to rename files."))
 472                                 return res, err
 473                         }
 474                         fileDir, err := readPath(cc.Server.Config.FileRoot, filePath, []byte{})
 475                         if err != nil {
 476                                 return nil, err
 477                         }
 478                         hlFile.name = string(fileNewName)
 479                         err = hlFile.move(fileDir)
 480                         if os.IsNotExist(err) {
 481                                 res = append(res, cc.NewErrReply(t, "Cannot rename file "+string(fileName)+" because it does not exist or cannot be found."))
 482                                 return res, err
 483                         }
 484                         if err != nil {
 485                                 return res, err
 486                         }
 487                 }
 488         }
 489
 490         res = append(res, cc.NewReply(t))
 491         return res, err
 492 }
 493
 494 // HandleDeleteFile deletes a file or folder
 495 // Fields used in the request:
 496 // * 201        File name
 497 // * 202        File path
 498 // Fields used in the reply: none
 499 func HandleDeleteFile(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 500         fileName := t.GetField(FieldFileName).Data
 501         filePath := t.GetField(FieldFilePath).Data
 502
 503         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
 504         if err != nil {
 505                 return res, err
 506         }
 507
 508         hlFile, err := newFileWrapper(cc.Server.FS, fullFilePath, 0)
 509         if err != nil {
 510                 return res, err
 511         }
 512
 513         fi, err := hlFile.dataFile()
 514         if err != nil {
 515                 res = append(res, cc.NewErrReply(t, "Cannot delete file "+string(fileName)+" because it does not exist or cannot be found."))
 516                 return res, nil
 517         }
 518
 519         switch mode := fi.Mode(); {
 520         case mode.IsDir():
 521                 if !cc.Authorize(accessDeleteFolder) {
 522                         res = append(res, cc.NewErrReply(t, "You are not allowed to delete folders."))
 523                         return res, err
 524                 }
 525         case mode.IsRegular():
 526                 if !cc.Authorize(accessDeleteFile) {
 527                         res = append(res, cc.NewErrReply(t, "You are not allowed to delete files."))
 528                         return res, err
 529                 }
 530         }
 531
 532         if err := hlFile.delete(); err != nil {
 533                 return res, err
 534         }
 535
 536         res = append(res, cc.NewReply(t))
 537         return res, err
 538 }
 539
 540 // HandleMoveFile moves files or folders. Note: seemingly not documented
 541 func HandleMoveFile(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 542         fileName := string(t.GetField(FieldFileName).Data)
 543
 544         filePath, err := readPath(cc.Server.Config.FileRoot, t.GetField(FieldFilePath).Data, t.GetField(FieldFileName).Data)
 545         if err != nil {
 546                 return res, err
 547         }
 548
 549         fileNewPath, err := readPath(cc.Server.Config.FileRoot, t.GetField(FieldFileNewPath).Data, nil)
 550         if err != nil {
 551                 return res, err
 552         }
 553
 554         cc.logger.Infow("Move file", "src", filePath+"/"+fileName, "dst", fileNewPath+"/"+fileName)
 555
 556         hlFile, err := newFileWrapper(cc.Server.FS, filePath, 0)
 557         if err != nil {
 558                 return res, err
 559         }
 560
 561         fi, err := hlFile.dataFile()
 562         if err != nil {
 563                 res = append(res, cc.NewErrReply(t, "Cannot delete file "+fileName+" because it does not exist or cannot be found."))
 564                 return res, err
 565         }
 566         if err != nil {
 567                 return res, err
 568         }
 569         switch mode := fi.Mode(); {
 570         case mode.IsDir():
 571                 if !cc.Authorize(accessMoveFolder) {
 572                         res = append(res, cc.NewErrReply(t, "You are not allowed to move folders."))
 573                         return res, err
 574                 }
 575         case mode.IsRegular():
 576                 if !cc.Authorize(accessMoveFile) {
 577                         res = append(res, cc.NewErrReply(t, "You are not allowed to move files."))
 578                         return res, err
 579                 }
 580         }
 581         if err := hlFile.move(fileNewPath); err != nil {
 582                 return res, err
 583         }
 584         // TODO: handle other possible errors; e.g. fileWrapper delete fails due to fileWrapper permission issue
 585
 586         res = append(res, cc.NewReply(t))
 587         return res, err
 588 }
 589
 590 func HandleNewFolder(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 591         if !cc.Authorize(accessCreateFolder) {
 592                 res = append(res, cc.NewErrReply(t, "You are not allowed to create folders."))
 593                 return res, err
 594         }
 595         folderName := string(t.GetField(FieldFileName).Data)
 596
 597         folderName = path.Join("/", folderName)
 598
 599         var subPath string
 600
 601         // FieldFilePath is only present for nested paths
 602         if t.GetField(FieldFilePath).Data != nil {
 603                 var newFp FilePath
 604                 _, err := newFp.Write(t.GetField(FieldFilePath).Data)
 605                 if err != nil {
 606                         return nil, err
 607                 }
 608
 609                 for _, pathItem := range newFp.Items {
 610                         subPath = filepath.Join("/", subPath, string(pathItem.Name))
 611                 }
 612         }
 613         newFolderPath := path.Join(cc.Server.Config.FileRoot, subPath, folderName)
 614
 615         // TODO: check path and folder name lengths
 616
 617         if _, err := cc.Server.FS.Stat(newFolderPath); !os.IsNotExist(err) {
 618                 msg := fmt.Sprintf("Cannot create folder \"%s\" because there is already a file or folder with that name.", folderName)
 619                 return []Transaction{cc.NewErrReply(t, msg)}, nil
 620         }
 621
 622         // TODO: check for disallowed characters to maintain compatibility for original client
 623
 624         if err := cc.Server.FS.Mkdir(newFolderPath, 0777); err != nil {
 625                 msg := fmt.Sprintf("Cannot create folder \"%s\" because an error occurred.", folderName)
 626                 return []Transaction{cc.NewErrReply(t, msg)}, nil
 627         }
 628
 629         res = append(res, cc.NewReply(t))
 630         return res, err
 631 }
 632
 633 func HandleSetUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 634         if !cc.Authorize(accessModifyUser) {
 635                 res = append(res, cc.NewErrReply(t, "You are not allowed to modify accounts."))
 636                 return res, err
 637         }
 638
 639         login := DecodeUserString(t.GetField(FieldUserLogin).Data)
 640         userName := string(t.GetField(FieldUserName).Data)
 641
 642         newAccessLvl := t.GetField(FieldUserAccess).Data
 643
 644         account := cc.Server.Accounts[login]
 645         account.Name = userName
 646         copy(account.Access[:], newAccessLvl)
 647
 648         // If the password field is cleared in the Hotline edit user UI, the SetUser transaction does
 649         // not include FieldUserPassword
 650         if t.GetField(FieldUserPassword).Data == nil {
 651                 account.Password = hashAndSalt([]byte(""))
 652         }
 653         if len(t.GetField(FieldUserPassword).Data) > 1 {
 654                 account.Password = hashAndSalt(t.GetField(FieldUserPassword).Data)
 655         }
 656
 657         out, err := yaml.Marshal(&account)
 658         if err != nil {
 659                 return res, err
 660         }
 661         if err := os.WriteFile(filepath.Join(cc.Server.ConfigDir, "Users", login+".yaml"), out, 0666); err != nil {
 662                 return res, err
 663         }
 664
 665         // Notify connected clients logged in as the user of the new access level
 666         for _, c := range cc.Server.Clients {
 667                 if c.Account.Login == login {
 668                         // Note: comment out these two lines to test server-side deny messages
 669                         newT := NewTransaction(TranUserAccess, c.ID, NewField(FieldUserAccess, newAccessLvl))
 670                         res = append(res, *newT)
 671
 672                         flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(c.Flags)))
 673                         if c.Authorize(accessDisconUser) {
 674                                 flagBitmap.SetBit(flagBitmap, UserFlagAdmin, 1)
 675                         } else {
 676                                 flagBitmap.SetBit(flagBitmap, UserFlagAdmin, 0)
 677                         }
 678                         binary.BigEndian.PutUint16(c.Flags, uint16(flagBitmap.Int64()))
 679
 680                         c.Account.Access = account.Access
 681
 682                         cc.sendAll(
 683                                 TranNotifyChangeUser,
 684                                 NewField(FieldUserID, *c.ID),
 685                                 NewField(FieldUserFlags, c.Flags),
 686                                 NewField(FieldUserName, c.UserName),
 687                                 NewField(FieldUserIconID, c.Icon),
 688                         )
 689                 }
 690         }
 691
 692         res = append(res, cc.NewReply(t))
 693         return res, err
 694 }
 695
 696 func HandleGetUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 697         if !cc.Authorize(accessOpenUser) {
 698                 res = append(res, cc.NewErrReply(t, "You are not allowed to view accounts."))
 699                 return res, err
 700         }
 701
 702         account := cc.Server.Accounts[string(t.GetField(FieldUserLogin).Data)]
 703         if account == nil {
 704                 res = append(res, cc.NewErrReply(t, "Account does not exist."))
 705                 return res, err
 706         }
 707
 708         res = append(res, cc.NewReply(t,
 709                 NewField(FieldUserName, []byte(account.Name)),
 710                 NewField(FieldUserLogin, negateString(t.GetField(FieldUserLogin).Data)),
 711                 NewField(FieldUserPassword, []byte(account.Password)),
 712                 NewField(FieldUserAccess, account.Access[:]),
 713         ))
 714         return res, err
 715 }
 716
 717 func HandleListUsers(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 718         if !cc.Authorize(accessOpenUser) {
 719                 res = append(res, cc.NewErrReply(t, "You are not allowed to view accounts."))
 720                 return res, err
 721         }
 722
 723         var userFields []Field
 724         for _, acc := range cc.Server.Accounts {
 725                 b := make([]byte, 0, 100)
 726                 n, err := acc.Read(b)
 727                 if err != nil {
 728                         return res, err
 729                 }
 730
 731                 userFields = append(userFields, NewField(FieldData, b[:n]))
 732         }
 733
 734         res = append(res, cc.NewReply(t, userFields...))
 735         return res, err
 736 }
 737
 738 // HandleUpdateUser is used by the v1.5+ multi-user editor to perform account editing for multiple users at a time.
 739 // An update can be a mix of these actions:
 740 // * Create user
 741 // * Delete user
 742 // * Modify user (including renaming the account login)
 743 //
 744 // The Transaction sent by the client includes one data field per user that was modified.  This data field in turn
 745 // contains another data field encoded in its payload with a varying number of sub fields depending on which action is
 746 // performed.  This seems to be the only place in the Hotline protocol where a data field contains another data field.
 747 func HandleUpdateUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 748         for _, field := range t.Fields {
 749                 subFields, err := ReadFields(field.Data[0:2], field.Data[2:])
 750                 if err != nil {
 751                         return res, err
 752                 }
 753
 754                 if len(subFields) == 1 {
 755                         login := DecodeUserString(getField(FieldData, &subFields).Data)
 756                         cc.logger.Infow("DeleteUser", "login", login)
 757
 758                         if !cc.Authorize(accessDeleteUser) {
 759                                 res = append(res, cc.NewErrReply(t, "You are not allowed to delete accounts."))
 760                                 return res, err
 761                         }
 762
 763                         if err := cc.Server.DeleteUser(login); err != nil {
 764                                 return res, err
 765                         }
 766                         continue
 767                 }
 768
 769                 login := DecodeUserString(getField(FieldUserLogin, &subFields).Data)
 770
 771                 // check if the login dataFile; if so, we know we are updating an existing user
 772                 if acc, ok := cc.Server.Accounts[login]; ok {
 773                         cc.logger.Infow("UpdateUser", "login", login)
 774
 775                         // account dataFile, so this is an update action
 776                         if !cc.Authorize(accessModifyUser) {
 777                                 res = append(res, cc.NewErrReply(t, "You are not allowed to modify accounts."))
 778                                 return res, err
 779                         }
 780
 781                         if getField(FieldUserPassword, &subFields) != nil {
 782                                 newPass := getField(FieldUserPassword, &subFields).Data
 783                                 acc.Password = hashAndSalt(newPass)
 784                         } else {
 785                                 acc.Password = hashAndSalt([]byte(""))
 786                         }
 787
 788                         if getField(FieldUserAccess, &subFields) != nil {
 789                                 copy(acc.Access[:], getField(FieldUserAccess, &subFields).Data)
 790                         }
 791
 792                         err = cc.Server.UpdateUser(
 793                                 DecodeUserString(getField(FieldData, &subFields).Data),
 794                                 DecodeUserString(getField(FieldUserLogin, &subFields).Data),
 795                                 string(getField(FieldUserName, &subFields).Data),
 796                                 acc.Password,
 797                                 acc.Access,
 798                         )
 799                         if err != nil {
 800                                 return res, err
 801                         }
 802                 } else {
 803                         cc.logger.Infow("CreateUser", "login", login)
 804
 805                         if !cc.Authorize(accessCreateUser) {
 806                                 res = append(res, cc.NewErrReply(t, "You are not allowed to create new accounts."))
 807                                 return res, err
 808                         }
 809
 810                         newAccess := accessBitmap{}
 811                         copy(newAccess[:], getField(FieldUserAccess, &subFields).Data)
 812
 813                         // Prevent account from creating new account with greater permission
 814                         for i := 0; i < 64; i++ {
 815                                 if newAccess.IsSet(i) {
 816                                         if !cc.Authorize(i) {
 817                                                 return append(res, cc.NewErrReply(t, "Cannot create account with more access than yourself.")), err
 818                                         }
 819                                 }
 820                         }
 821
 822                         err := cc.Server.NewUser(login, string(getField(FieldUserName, &subFields).Data), string(getField(FieldUserPassword, &subFields).Data), newAccess)
 823                         if err != nil {
 824                                 return []Transaction{}, err
 825                         }
 826                 }
 827         }
 828
 829         res = append(res, cc.NewReply(t))
 830         return res, err
 831 }
 832
 833 // HandleNewUser creates a new user account
 834 func HandleNewUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 835         if !cc.Authorize(accessCreateUser) {
 836                 res = append(res, cc.NewErrReply(t, "You are not allowed to create new accounts."))
 837                 return res, err
 838         }
 839
 840         login := DecodeUserString(t.GetField(FieldUserLogin).Data)
 841
 842         // If the account already dataFile, reply with an error
 843         if _, ok := cc.Server.Accounts[login]; ok {
 844                 res = append(res, cc.NewErrReply(t, "Cannot create account "+login+" because there is already an account with that login."))
 845                 return res, err
 846         }
 847
 848         newAccess := accessBitmap{}
 849         copy(newAccess[:], t.GetField(FieldUserAccess).Data)
 850
 851         // Prevent account from creating new account with greater permission
 852         for i := 0; i < 64; i++ {
 853                 if newAccess.IsSet(i) {
 854                         if !cc.Authorize(i) {
 855                                 res = append(res, cc.NewErrReply(t, "Cannot create account with more access than yourself."))
 856                                 return res, err
 857                         }
 858                 }
 859         }
 860
 861         if err := cc.Server.NewUser(login, string(t.GetField(FieldUserName).Data), string(t.GetField(FieldUserPassword).Data), newAccess); err != nil {
 862                 return []Transaction{}, err
 863         }
 864
 865         res = append(res, cc.NewReply(t))
 866         return res, err
 867 }
 868
 869 func HandleDeleteUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 870         if !cc.Authorize(accessDeleteUser) {
 871                 res = append(res, cc.NewErrReply(t, "You are not allowed to delete accounts."))
 872                 return res, err
 873         }
 874
 875         // TODO: Handle case where account doesn't exist; e.g. delete race condition
 876         login := DecodeUserString(t.GetField(FieldUserLogin).Data)
 877
 878         if err := cc.Server.DeleteUser(login); err != nil {
 879                 return res, err
 880         }
 881
 882         res = append(res, cc.NewReply(t))
 883         return res, err
 884 }
 885
 886 // HandleUserBroadcast sends an Administrator Message to all connected clients of the server
 887 func HandleUserBroadcast(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 888         if !cc.Authorize(accessBroadcast) {
 889                 res = append(res, cc.NewErrReply(t, "You are not allowed to send broadcast messages."))
 890                 return res, err
 891         }
 892
 893         cc.sendAll(
 894                 TranServerMsg,
 895                 NewField(FieldData, t.GetField(TranGetMsgs).Data),
 896                 NewField(FieldChatOptions, []byte{0}),
 897         )
 898
 899         res = append(res, cc.NewReply(t))
 900         return res, err
 901 }
 902
 903 // HandleGetClientInfoText returns user information for the specific user.
 904 //
 905 // Fields used in the request:
 906 // 103  User ID
 907 //
 908 // Fields used in the reply:
 909 // 102  User name
 910 // 101  Data            User info text string
 911 func HandleGetClientInfoText(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 912         if !cc.Authorize(accessGetClientInfo) {
 913                 res = append(res, cc.NewErrReply(t, "You are not allowed to get client info."))
 914                 return res, err
 915         }
 916
 917         clientID, _ := byteToInt(t.GetField(FieldUserID).Data)
 918
 919         clientConn := cc.Server.Clients[uint16(clientID)]
 920         if clientConn == nil {
 921                 return append(res, cc.NewErrReply(t, "User not found.")), err
 922         }
 923
 924         res = append(res, cc.NewReply(t,
 925                 NewField(FieldData, []byte(clientConn.String())),
 926                 NewField(FieldUserName, clientConn.UserName),
 927         ))
 928         return res, err
 929 }
 930
 931 func HandleGetUserNameList(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 932         res = append(res, cc.NewReply(t, cc.Server.connectedUsers()...))
 933
 934         return res, err
 935 }
 936
 937 func HandleTranAgreed(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 938         if t.GetField(FieldUserName).Data != nil {
 939                 if cc.Authorize(accessAnyName) {
 940                         cc.UserName = t.GetField(FieldUserName).Data
 941                 } else {
 942                         cc.UserName = []byte(cc.Account.Name)
 943                 }
 944         }
 945
 946         cc.Icon = t.GetField(FieldUserIconID).Data
 947
 948         cc.logger = cc.logger.With("name", string(cc.UserName))
 949         cc.logger.Infow("Login successful", "clientVersion", fmt.Sprintf("%v", func() int { i, _ := byteToInt(cc.Version); return i }()))
 950
 951         options := t.GetField(FieldOptions).Data
 952         optBitmap := big.NewInt(int64(binary.BigEndian.Uint16(options)))
 953
 954         flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(cc.Flags)))
 955
 956         // Check refuse private PM option
 957         if optBitmap.Bit(refusePM) == 1 {
 958                 flagBitmap.SetBit(flagBitmap, UserFlagRefusePM, 1)
 959                 binary.BigEndian.PutUint16(cc.Flags, uint16(flagBitmap.Int64()))
 960         }
 961
 962         // Check refuse private chat option
 963         if optBitmap.Bit(refuseChat) == 1 {
 964                 flagBitmap.SetBit(flagBitmap, UserFlagRefusePChat, 1)
 965                 binary.BigEndian.PutUint16(cc.Flags, uint16(flagBitmap.Int64()))
 966         }
 967
 968         // Check auto response
 969         if optBitmap.Bit(autoResponse) == 1 {
 970                 cc.AutoReply = t.GetField(FieldAutomaticResponse).Data
 971         } else {
 972                 cc.AutoReply = []byte{}
 973         }
 974
 975         trans := cc.notifyOthers(
 976                 *NewTransaction(
 977                         TranNotifyChangeUser, nil,
 978                         NewField(FieldUserName, cc.UserName),
 979                         NewField(FieldUserID, *cc.ID),
 980                         NewField(FieldUserIconID, cc.Icon),
 981                         NewField(FieldUserFlags, cc.Flags),
 982                 ),
 983         )
 984         res = append(res, trans...)
 985
 986         if cc.Server.Config.BannerFile != "" {
 987                 res = append(res, *NewTransaction(TranServerBanner, cc.ID, NewField(FieldBannerType, []byte("JPEG"))))
 988         }
 989
 990         res = append(res, cc.NewReply(t))
 991
 992         return res, err
 993 }
 994
 995 // HandleTranOldPostNews updates the flat news
 996 // Fields used in this request:
 997 // 101  Data
 998 func HandleTranOldPostNews(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 999         if !cc.Authorize(accessNewsPostArt) {
1000                 res = append(res, cc.NewErrReply(t, "You are not allowed to post news."))
1001                 return res, err
1002         }
1003
1004         cc.Server.flatNewsMux.Lock()
1005         defer cc.Server.flatNewsMux.Unlock()
1006
1007         newsDateTemplate := defaultNewsDateFormat
1008         if cc.Server.Config.NewsDateFormat != "" {
1009                 newsDateTemplate = cc.Server.Config.NewsDateFormat
1010         }
1011
1012         newsTemplate := defaultNewsTemplate
1013         if cc.Server.Config.NewsDelimiter != "" {
1014                 newsTemplate = cc.Server.Config.NewsDelimiter
1015         }
1016
1017         newsPost := fmt.Sprintf(newsTemplate+"\r", cc.UserName, time.Now().Format(newsDateTemplate), t.GetField(FieldData).Data)
1018         newsPost = strings.ReplaceAll(newsPost, "\n", "\r")
1019
1020         // update news in memory
1021         cc.Server.FlatNews = append([]byte(newsPost), cc.Server.FlatNews...)
1022
1023         // update news on disk
1024         if err := cc.Server.FS.WriteFile(filepath.Join(cc.Server.ConfigDir, "MessageBoard.txt"), cc.Server.FlatNews, 0644); err != nil {
1025                 return res, err
1026         }
1027
1028         // Notify all clients of updated news
1029         cc.sendAll(
1030                 TranNewMsg,
1031                 NewField(FieldData, []byte(newsPost)),
1032         )
1033
1034         res = append(res, cc.NewReply(t))
1035         return res, err
1036 }
1037
1038 func HandleDisconnectUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1039         if !cc.Authorize(accessDisconUser) {
1040                 res = append(res, cc.NewErrReply(t, "You are not allowed to disconnect users."))
1041                 return res, err
1042         }
1043
1044         clientConn := cc.Server.Clients[binary.BigEndian.Uint16(t.GetField(FieldUserID).Data)]
1045
1046         if clientConn.Authorize(accessCannotBeDiscon) {
1047                 res = append(res, cc.NewErrReply(t, clientConn.Account.Login+" is not allowed to be disconnected."))
1048                 return res, err
1049         }
1050
1051         // If FieldOptions is set, then the client IP is banned in addition to disconnected.
1052         // 00 01 = temporary ban
1053         // 00 02 = permanent ban
1054         if t.GetField(FieldOptions).Data != nil {
1055                 switch t.GetField(FieldOptions).Data[1] {
1056                 case 1:
1057                         // send message: "You are temporarily banned on this server"
1058                         cc.logger.Infow("Disconnect & temporarily ban " + string(clientConn.UserName))
1059
1060                         res = append(res, *NewTransaction(
1061                                 TranServerMsg,
1062                                 clientConn.ID,
1063                                 NewField(FieldData, []byte("You are temporarily banned on this server")),
1064                                 NewField(FieldChatOptions, []byte{0, 0}),
1065                         ))
1066
1067                         banUntil := time.Now().Add(tempBanDuration)
1068                         cc.Server.banList[strings.Split(clientConn.RemoteAddr, ":")[0]] = &banUntil
1069                 case 2:
1070                         // send message: "You are permanently banned on this server"
1071                         cc.logger.Infow("Disconnect & ban " + string(clientConn.UserName))
1072
1073                         res = append(res, *NewTransaction(
1074                                 TranServerMsg,
1075                                 clientConn.ID,
1076                                 NewField(FieldData, []byte("You are permanently banned on this server")),
1077                                 NewField(FieldChatOptions, []byte{0, 0}),
1078                         ))
1079
1080                         cc.Server.banList[strings.Split(clientConn.RemoteAddr, ":")[0]] = nil
1081                 }
1082
1083                 err := cc.Server.writeBanList()
1084                 if err != nil {
1085                         return res, err
1086                 }
1087         }
1088
1089         // TODO: remove this awful hack
1090         go func() {
1091                 time.Sleep(1 * time.Second)
1092                 clientConn.Disconnect()
1093         }()
1094
1095         return append(res, cc.NewReply(t)), err
1096 }
1097
1098 // HandleGetNewsCatNameList returns a list of news categories for a path
1099 // Fields used in the request:
1100 // 325  News path       (Optional)
1101 func HandleGetNewsCatNameList(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1102         if !cc.Authorize(accessNewsReadArt) {
1103                 res = append(res, cc.NewErrReply(t, "You are not allowed to read news."))
1104                 return res, err
1105         }
1106
1107         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1108         cats := cc.Server.GetNewsCatByPath(pathStrs)
1109
1110         // To store the keys in slice in sorted order
1111         keys := make([]string, len(cats))
1112         i := 0
1113         for k := range cats {
1114                 keys[i] = k
1115                 i++
1116         }
1117         sort.Strings(keys)
1118
1119         var fieldData []Field
1120         for _, k := range keys {
1121                 cat := cats[k]
1122                 b, _ := cat.MarshalBinary()
1123                 fieldData = append(fieldData, NewField(
1124                         FieldNewsCatListData15,
1125                         b,
1126                 ))
1127         }
1128
1129         res = append(res, cc.NewReply(t, fieldData...))
1130         return res, err
1131 }
1132
1133 func HandleNewNewsCat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1134         if !cc.Authorize(accessNewsCreateCat) {
1135                 res = append(res, cc.NewErrReply(t, "You are not allowed to create news categories."))
1136                 return res, err
1137         }
1138
1139         name := string(t.GetField(FieldNewsCatName).Data)
1140         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1141
1142         cats := cc.Server.GetNewsCatByPath(pathStrs)
1143         cats[name] = NewsCategoryListData15{
1144                 Name:     name,
1145                 Type:     []byte{0, 3},
1146                 Articles: map[uint32]*NewsArtData{},
1147                 SubCats:  make(map[string]NewsCategoryListData15),
1148         }
1149
1150         if err := cc.Server.writeThreadedNews(); err != nil {
1151                 return res, err
1152         }
1153         res = append(res, cc.NewReply(t))
1154         return res, err
1155 }
1156
1157 // Fields used in the request:
1158 // 322  News category name
1159 // 325  News path
1160 func HandleNewNewsFldr(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1161         if !cc.Authorize(accessNewsCreateFldr) {
1162                 res = append(res, cc.NewErrReply(t, "You are not allowed to create news folders."))
1163                 return res, err
1164         }
1165
1166         name := string(t.GetField(FieldFileName).Data)
1167         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1168
1169         cc.logger.Infof("Creating new news folder %s", name)
1170
1171         cats := cc.Server.GetNewsCatByPath(pathStrs)
1172         cats[name] = NewsCategoryListData15{
1173                 Name:     name,
1174                 Type:     []byte{0, 2},
1175                 Articles: map[uint32]*NewsArtData{},
1176                 SubCats:  make(map[string]NewsCategoryListData15),
1177         }
1178         if err := cc.Server.writeThreadedNews(); err != nil {
1179                 return res, err
1180         }
1181         res = append(res, cc.NewReply(t))
1182         return res, err
1183 }
1184
1185 // HandleGetNewsArtData gets the list of article names at the specified news path.
1186
1187 // Fields used in the request:
1188 // 325  News path       Optional
1189
1190 // Fields used in the reply:
1191 // 321  News article list data  Optional
1192 func HandleGetNewsArtNameList(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1193         if !cc.Authorize(accessNewsReadArt) {
1194                 res = append(res, cc.NewErrReply(t, "You are not allowed to read news."))
1195                 return res, err
1196         }
1197         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1198
1199         var cat NewsCategoryListData15
1200         cats := cc.Server.ThreadedNews.Categories
1201
1202         for _, fp := range pathStrs {
1203                 cat = cats[fp]
1204                 cats = cats[fp].SubCats
1205         }
1206
1207         nald := cat.GetNewsArtListData()
1208
1209         res = append(res, cc.NewReply(t, NewField(FieldNewsArtListData, nald.Payload())))
1210         return res, err
1211 }
1212
1213 // HandleGetNewsArtData requests information about the specific news article.
1214 // Fields used in the request:
1215 //
1216 // Request fields
1217 // 325  News path
1218 // 326  News article ID
1219 // 327  News article data flavor
1220 //
1221 // Fields used in the reply:
1222 // 328  News article title
1223 // 329  News article poster
1224 // 330  News article date
1225 // 331  Previous article ID
1226 // 332  Next article ID
1227 // 335  Parent article ID
1228 // 336  First child article ID
1229 // 327  News article data flavor        "Should be “text/plain”
1230 // 333  News article data       Optional (if data flavor is “text/plain”)
1231 func HandleGetNewsArtData(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1232         if !cc.Authorize(accessNewsReadArt) {
1233                 res = append(res, cc.NewErrReply(t, "You are not allowed to read news."))
1234                 return res, err
1235         }
1236
1237         var cat NewsCategoryListData15
1238         cats := cc.Server.ThreadedNews.Categories
1239
1240         for _, fp := range ReadNewsPath(t.GetField(FieldNewsPath).Data) {
1241                 cat = cats[fp]
1242                 cats = cats[fp].SubCats
1243         }
1244
1245         // The official Hotline clients will send the article ID as 2 bytes if possible, but
1246         // some third party clients such as Frogblast and Heildrun will always send 4 bytes
1247         convertedID, err := byteToInt(t.GetField(FieldNewsArtID).Data)
1248         if err != nil {
1249                 return res, err
1250         }
1251
1252         art := cat.Articles[uint32(convertedID)]
1253         if art == nil {
1254                 res = append(res, cc.NewReply(t))
1255                 return res, err
1256         }
1257
1258         res = append(res, cc.NewReply(t,
1259                 NewField(FieldNewsArtTitle, []byte(art.Title)),
1260                 NewField(FieldNewsArtPoster, []byte(art.Poster)),
1261                 NewField(FieldNewsArtDate, art.Date),
1262                 NewField(FieldNewsArtPrevArt, art.PrevArt),
1263                 NewField(FieldNewsArtNextArt, art.NextArt),
1264                 NewField(FieldNewsArtParentArt, art.ParentArt),
1265                 NewField(FieldNewsArt1stChildArt, art.FirstChildArt),
1266                 NewField(FieldNewsArtDataFlav, []byte("text/plain")),
1267                 NewField(FieldNewsArtData, []byte(art.Data)),
1268         ))
1269         return res, err
1270 }
1271
1272 // HandleDelNewsItem deletes an existing threaded news folder or category from the server.
1273 // Fields used in the request:
1274 // 325  News path
1275 // Fields used in the reply:
1276 // None
1277 func HandleDelNewsItem(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1278         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1279
1280         cats := cc.Server.ThreadedNews.Categories
1281         delName := pathStrs[len(pathStrs)-1]
1282         if len(pathStrs) > 1 {
1283                 for _, fp := range pathStrs[0 : len(pathStrs)-1] {
1284                         cats = cats[fp].SubCats
1285                 }
1286         }
1287
1288         if bytes.Equal(cats[delName].Type, []byte{0, 3}) {
1289                 if !cc.Authorize(accessNewsDeleteCat) {
1290                         return append(res, cc.NewErrReply(t, "You are not allowed to delete news categories.")), nil
1291                 }
1292         } else {
1293                 if !cc.Authorize(accessNewsDeleteFldr) {
1294                         return append(res, cc.NewErrReply(t, "You are not allowed to delete news folders.")), nil
1295                 }
1296         }
1297
1298         delete(cats, delName)
1299
1300         if err := cc.Server.writeThreadedNews(); err != nil {
1301                 return res, err
1302         }
1303
1304         return append(res, cc.NewReply(t)), nil
1305 }
1306
1307 func HandleDelNewsArt(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1308         if !cc.Authorize(accessNewsDeleteArt) {
1309                 res = append(res, cc.NewErrReply(t, "You are not allowed to delete news articles."))
1310                 return res, err
1311         }
1312
1313         // Request Fields
1314         // 325  News path
1315         // 326  News article ID
1316         // 337  News article – recursive delete       Delete child articles (1) or not (0)
1317         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1318         ID, err := byteToInt(t.GetField(FieldNewsArtID).Data)
1319         if err != nil {
1320                 return res, err
1321         }
1322
1323         // TODO: Delete recursive
1324         cats := cc.Server.GetNewsCatByPath(pathStrs[:len(pathStrs)-1])
1325
1326         catName := pathStrs[len(pathStrs)-1]
1327         cat := cats[catName]
1328
1329         delete(cat.Articles, uint32(ID))
1330
1331         cats[catName] = cat
1332         if err := cc.Server.writeThreadedNews(); err != nil {
1333                 return res, err
1334         }
1335
1336         res = append(res, cc.NewReply(t))
1337         return res, err
1338 }
1339
1340 // Request fields
1341 // 325  News path
1342 // 326  News article ID                                                 ID of the parent article?
1343 // 328  News article title
1344 // 334  News article flags
1345 // 327  News article data flavor                Currently “text/plain”
1346 // 333  News article data
1347 func HandlePostNewsArt(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1348         if !cc.Authorize(accessNewsPostArt) {
1349                 res = append(res, cc.NewErrReply(t, "You are not allowed to post news articles."))
1350                 return res, err
1351         }
1352
1353         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1354         cats := cc.Server.GetNewsCatByPath(pathStrs[:len(pathStrs)-1])
1355
1356         catName := pathStrs[len(pathStrs)-1]
1357         cat := cats[catName]
1358
1359         artID, err := byteToInt(t.GetField(FieldNewsArtID).Data)
1360         if err != nil {
1361                 return res, err
1362         }
1363         convertedArtID := uint32(artID)
1364         bs := make([]byte, 4)
1365         binary.BigEndian.PutUint32(bs, convertedArtID)
1366
1367         newArt := NewsArtData{
1368                 Title:         string(t.GetField(FieldNewsArtTitle).Data),
1369                 Poster:        string(cc.UserName),
1370                 Date:          toHotlineTime(time.Now()),
1371                 PrevArt:       []byte{0, 0, 0, 0},
1372                 NextArt:       []byte{0, 0, 0, 0},
1373                 ParentArt:     bs,
1374                 FirstChildArt: []byte{0, 0, 0, 0},
1375                 DataFlav:      []byte("text/plain"),
1376                 Data:          string(t.GetField(FieldNewsArtData).Data),
1377         }
1378
1379         var keys []int
1380         for k := range cat.Articles {
1381                 keys = append(keys, int(k))
1382         }
1383
1384         nextID := uint32(1)
1385         if len(keys) > 0 {
1386                 sort.Ints(keys)
1387                 prevID := uint32(keys[len(keys)-1])
1388                 nextID = prevID + 1
1389
1390                 binary.BigEndian.PutUint32(newArt.PrevArt, prevID)
1391
1392                 // Set next article ID
1393                 binary.BigEndian.PutUint32(cat.Articles[prevID].NextArt, nextID)
1394         }
1395
1396         // Update parent article with first child reply
1397         parentID := convertedArtID
1398         if parentID != 0 {
1399                 parentArt := cat.Articles[parentID]
1400
1401                 if bytes.Equal(parentArt.FirstChildArt, []byte{0, 0, 0, 0}) {
1402                         binary.BigEndian.PutUint32(parentArt.FirstChildArt, nextID)
1403                 }
1404         }
1405
1406         cat.Articles[nextID] = &newArt
1407
1408         cats[catName] = cat
1409         if err := cc.Server.writeThreadedNews(); err != nil {
1410                 return res, err
1411         }
1412
1413         res = append(res, cc.NewReply(t))
1414         return res, err
1415 }
1416
1417 // HandleGetMsgs returns the flat news data
1418 func HandleGetMsgs(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1419         if !cc.Authorize(accessNewsReadArt) {
1420                 res = append(res, cc.NewErrReply(t, "You are not allowed to read news."))
1421                 return res, err
1422         }
1423
1424         res = append(res, cc.NewReply(t, NewField(FieldData, cc.Server.FlatNews)))
1425
1426         return res, err
1427 }
1428
1429 func HandleDownloadFile(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1430         if !cc.Authorize(accessDownloadFile) {
1431                 res = append(res, cc.NewErrReply(t, "You are not allowed to download files."))
1432                 return res, err
1433         }
1434
1435         fileName := t.GetField(FieldFileName).Data
1436         filePath := t.GetField(FieldFilePath).Data
1437         resumeData := t.GetField(FieldFileResumeData).Data
1438
1439         var dataOffset int64
1440         var frd FileResumeData
1441         if resumeData != nil {
1442                 if err := frd.UnmarshalBinary(t.GetField(FieldFileResumeData).Data); err != nil {
1443                         return res, err
1444                 }
1445                 // TODO: handle rsrc fork offset
1446                 dataOffset = int64(binary.BigEndian.Uint32(frd.ForkInfoList[0].DataSize[:]))
1447         }
1448
1449         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
1450         if err != nil {
1451                 return res, err
1452         }
1453
1454         hlFile, err := newFileWrapper(cc.Server.FS, fullFilePath, dataOffset)
1455         if err != nil {
1456                 return res, err
1457         }
1458
1459         xferSize := hlFile.ffo.TransferSize(0)
1460
1461         ft := cc.newFileTransfer(FileDownload, fileName, filePath, xferSize)
1462
1463         // TODO: refactor to remove this
1464         if resumeData != nil {
1465                 var frd FileResumeData
1466                 if err := frd.UnmarshalBinary(t.GetField(FieldFileResumeData).Data); err != nil {
1467                         return res, err
1468                 }
1469                 ft.fileResumeData = &frd
1470         }
1471
1472         // Optional field for when a HL v1.5+ client requests file preview
1473         // Used only for TEXT, JPEG, GIFF, BMP or PICT files
1474         // The value will always be 2
1475         if t.GetField(FieldFileTransferOptions).Data != nil {
1476                 ft.options = t.GetField(FieldFileTransferOptions).Data
1477                 xferSize = hlFile.ffo.FlatFileDataForkHeader.DataSize[:]
1478         }
1479
1480         res = append(res, cc.NewReply(t,
1481                 NewField(FieldRefNum, ft.refNum[:]),
1482                 NewField(FieldWaitingCount, []byte{0x00, 0x00}), // TODO: Implement waiting count
1483                 NewField(FieldTransferSize, xferSize),
1484                 NewField(FieldFileSize, hlFile.ffo.FlatFileDataForkHeader.DataSize[:]),
1485         ))
1486
1487         return res, err
1488 }
1489
1490 // Download all files from the specified folder and sub-folders
1491 func HandleDownloadFolder(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1492         if !cc.Authorize(accessDownloadFile) {
1493                 res = append(res, cc.NewErrReply(t, "You are not allowed to download folders."))
1494                 return res, err
1495         }
1496
1497         fullFilePath, err := readPath(cc.Server.Config.FileRoot, t.GetField(FieldFilePath).Data, t.GetField(FieldFileName).Data)
1498         if err != nil {
1499                 return res, err
1500         }
1501
1502         transferSize, err := CalcTotalSize(fullFilePath)
1503         if err != nil {
1504                 return res, err
1505         }
1506         itemCount, err := CalcItemCount(fullFilePath)
1507         if err != nil {
1508                 return res, err
1509         }
1510
1511         fileTransfer := cc.newFileTransfer(FolderDownload, t.GetField(FieldFileName).Data, t.GetField(FieldFilePath).Data, transferSize)
1512
1513         var fp FilePath
1514         _, err = fp.Write(t.GetField(FieldFilePath).Data)
1515         if err != nil {
1516                 return res, err
1517         }
1518
1519         res = append(res, cc.NewReply(t,
1520                 NewField(FieldRefNum, fileTransfer.ReferenceNumber),
1521                 NewField(FieldTransferSize, transferSize),
1522                 NewField(FieldFolderItemCount, itemCount),
1523                 NewField(FieldWaitingCount, []byte{0x00, 0x00}), // TODO: Implement waiting count
1524         ))
1525         return res, err
1526 }
1527
1528 // Upload all files from the local folder and its subfolders to the specified path on the server
1529 // Fields used in the request
1530 // 201  File name
1531 // 202  File path
1532 // 108  transfer size   Total size of all items in the folder
1533 // 220  Folder item count
1534 // 204  File transfer options   "Optional Currently set to 1" (TODO: ??)
1535 func HandleUploadFolder(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1536         var fp FilePath
1537         if t.GetField(FieldFilePath).Data != nil {
1538                 if _, err = fp.Write(t.GetField(FieldFilePath).Data); err != nil {
1539                         return res, err
1540                 }
1541         }
1542
1543         // Handle special cases for Upload and Drop Box folders
1544         if !cc.Authorize(accessUploadAnywhere) {
1545                 if !fp.IsUploadDir() && !fp.IsDropbox() {
1546                         res = append(res, cc.NewErrReply(t, fmt.Sprintf("Cannot accept upload of the folder \"%v\" because you are only allowed to upload to the \"Uploads\" folder.", string(t.GetField(FieldFileName).Data))))
1547                         return res, err
1548                 }
1549         }
1550
1551         fileTransfer := cc.newFileTransfer(FolderUpload,
1552                 t.GetField(FieldFileName).Data,
1553                 t.GetField(FieldFilePath).Data,
1554                 t.GetField(FieldTransferSize).Data,
1555         )
1556
1557         fileTransfer.FolderItemCount = t.GetField(FieldFolderItemCount).Data
1558
1559         res = append(res, cc.NewReply(t, NewField(FieldRefNum, fileTransfer.ReferenceNumber)))
1560         return res, err
1561 }
1562
1563 // HandleUploadFile
1564 // Fields used in the request:
1565 // 201  File name
1566 // 202  File path
1567 // 204  File transfer options   "Optional
1568 // Used only to resume download, currently has value 2"
1569 // 108  File transfer size      "Optional used if download is not resumed"
1570 func HandleUploadFile(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1571         if !cc.Authorize(accessUploadFile) {
1572                 res = append(res, cc.NewErrReply(t, "You are not allowed to upload files."))
1573                 return res, err
1574         }
1575
1576         fileName := t.GetField(FieldFileName).Data
1577         filePath := t.GetField(FieldFilePath).Data
1578         transferOptions := t.GetField(FieldFileTransferOptions).Data
1579         transferSize := t.GetField(FieldTransferSize).Data // not sent for resume
1580
1581         var fp FilePath
1582         if filePath != nil {
1583                 if _, err = fp.Write(filePath); err != nil {
1584                         return res, err
1585                 }
1586         }
1587
1588         // Handle special cases for Upload and Drop Box folders
1589         if !cc.Authorize(accessUploadAnywhere) {
1590                 if !fp.IsUploadDir() && !fp.IsDropbox() {
1591                         res = append(res, cc.NewErrReply(t, fmt.Sprintf("Cannot accept upload of the file \"%v\" because you are only allowed to upload to the \"Uploads\" folder.", string(fileName))))
1592                         return res, err
1593                 }
1594         }
1595         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
1596         if err != nil {
1597                 return res, err
1598         }
1599
1600         if _, err := cc.Server.FS.Stat(fullFilePath); err == nil {
1601                 res = append(res, cc.NewErrReply(t, fmt.Sprintf("Cannot accept upload because there is already a file named \"%v\".  Try choosing a different name.", string(fileName))))
1602                 return res, err
1603         }
1604
1605         ft := cc.newFileTransfer(FileUpload, fileName, filePath, transferSize)
1606
1607         replyT := cc.NewReply(t, NewField(FieldRefNum, ft.ReferenceNumber))
1608
1609         // client has requested to resume a partially transferred file
1610         if transferOptions != nil {
1611                 fileInfo, err := cc.Server.FS.Stat(fullFilePath + incompleteFileSuffix)
1612                 if err != nil {
1613                         return res, err
1614                 }
1615
1616                 offset := make([]byte, 4)
1617                 binary.BigEndian.PutUint32(offset, uint32(fileInfo.Size()))
1618
1619                 fileResumeData := NewFileResumeData([]ForkInfoList{
1620                         *NewForkInfoList(offset),
1621                 })
1622
1623                 b, _ := fileResumeData.BinaryMarshal()
1624
1625                 ft.TransferSize = offset
1626
1627                 replyT.Fields = append(replyT.Fields, NewField(FieldFileResumeData, b))
1628         }
1629
1630         res = append(res, replyT)
1631         return res, err
1632 }
1633
1634 func HandleSetClientUserInfo(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1635         if len(t.GetField(FieldUserIconID).Data) == 4 {
1636                 cc.Icon = t.GetField(FieldUserIconID).Data[2:]
1637         } else {
1638                 cc.Icon = t.GetField(FieldUserIconID).Data
1639         }
1640         if cc.Authorize(accessAnyName) {
1641                 cc.UserName = t.GetField(FieldUserName).Data
1642         }
1643
1644         // the options field is only passed by the client versions > 1.2.3.
1645         options := t.GetField(FieldOptions).Data
1646         if options != nil {
1647                 optBitmap := big.NewInt(int64(binary.BigEndian.Uint16(options)))
1648                 flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(cc.Flags)))
1649
1650                 flagBitmap.SetBit(flagBitmap, UserFlagRefusePM, optBitmap.Bit(refusePM))
1651                 binary.BigEndian.PutUint16(cc.Flags, uint16(flagBitmap.Int64()))
1652
1653                 flagBitmap.SetBit(flagBitmap, UserFlagRefusePChat, optBitmap.Bit(refuseChat))
1654                 binary.BigEndian.PutUint16(cc.Flags, uint16(flagBitmap.Int64()))
1655
1656                 // Check auto response
1657                 if optBitmap.Bit(autoResponse) == 1 {
1658                         cc.AutoReply = t.GetField(FieldAutomaticResponse).Data
1659                 } else {
1660                         cc.AutoReply = []byte{}
1661                 }
1662         }
1663
1664         for _, c := range sortedClients(cc.Server.Clients) {
1665                 res = append(res, *NewTransaction(
1666                         TranNotifyChangeUser,
1667                         c.ID,
1668                         NewField(FieldUserID, *cc.ID),
1669                         NewField(FieldUserIconID, cc.Icon),
1670                         NewField(FieldUserFlags, cc.Flags),
1671                         NewField(FieldUserName, cc.UserName),
1672                 ))
1673         }
1674
1675         return res, err
1676 }
1677
1678 // HandleKeepAlive responds to keepalive transactions with an empty reply
1679 // * HL 1.9.2 Client sends keepalive msg every 3 minutes
1680 // * HL 1.2.3 Client doesn't send keepalives
1681 func HandleKeepAlive(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1682         res = append(res, cc.NewReply(t))
1683
1684         return res, err
1685 }
1686
1687 func HandleGetFileNameList(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1688         fullPath, err := readPath(
1689                 cc.Server.Config.FileRoot,
1690                 t.GetField(FieldFilePath).Data,
1691                 nil,
1692         )
1693         if err != nil {
1694                 return res, err
1695         }
1696
1697         var fp FilePath
1698         if t.GetField(FieldFilePath).Data != nil {
1699                 if _, err = fp.Write(t.GetField(FieldFilePath).Data); err != nil {
1700                         return res, err
1701                 }
1702         }
1703
1704         // Handle special case for drop box folders
1705         if fp.IsDropbox() && !cc.Authorize(accessViewDropBoxes) {
1706                 res = append(res, cc.NewErrReply(t, "You are not allowed to view drop boxes."))
1707                 return res, err
1708         }
1709
1710         fileNames, err := getFileNameList(fullPath, cc.Server.Config.IgnoreFiles)
1711         if err != nil {
1712                 return res, err
1713         }
1714
1715         res = append(res, cc.NewReply(t, fileNames...))
1716
1717         return res, err
1718 }
1719
1720 // =================================
1721 //     Hotline private chat flow
1722 // =================================
1723 // 1. ClientA sends TranInviteNewChat to server with user ID to invite
1724 // 2. Server creates new ChatID
1725 // 3. Server sends TranInviteToChat to invitee
1726 // 4. Server replies to ClientA with new Chat ID
1727 //
1728 // A dialog box pops up in the invitee client with options to accept or decline the invitation.
1729 // If Accepted is clicked:
1730 // 1. ClientB sends TranJoinChat with FieldChatID
1731
1732 // HandleInviteNewChat invites users to new private chat
1733 func HandleInviteNewChat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1734         if !cc.Authorize(accessOpenChat) {
1735                 res = append(res, cc.NewErrReply(t, "You are not allowed to request private chat."))
1736                 return res, err
1737         }
1738
1739         // Client to Invite
1740         targetID := t.GetField(FieldUserID).Data
1741         newChatID := cc.Server.NewPrivateChat(cc)
1742
1743         // Check if target user has "Refuse private chat" flag
1744         binary.BigEndian.Uint16(targetID)
1745         targetClient := cc.Server.Clients[binary.BigEndian.Uint16(targetID)]
1746
1747         flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(targetClient.Flags)))
1748         if flagBitmap.Bit(UserFlagRefusePChat) == 1 {
1749                 res = append(res,
1750                         *NewTransaction(
1751                                 TranServerMsg,
1752                                 cc.ID,
1753                                 NewField(FieldData, []byte(string(targetClient.UserName)+" does not accept private chats.")),
1754                                 NewField(FieldUserName, targetClient.UserName),
1755                                 NewField(FieldUserID, *targetClient.ID),
1756                                 NewField(FieldOptions, []byte{0, 2}),
1757                         ),
1758                 )
1759         } else {
1760                 res = append(res,
1761                         *NewTransaction(
1762                                 TranInviteToChat,
1763                                 &targetID,
1764                                 NewField(FieldChatID, newChatID),
1765                                 NewField(FieldUserName, cc.UserName),
1766                                 NewField(FieldUserID, *cc.ID),
1767                         ),
1768                 )
1769         }
1770
1771         res = append(res,
1772                 cc.NewReply(t,
1773                         NewField(FieldChatID, newChatID),
1774                         NewField(FieldUserName, cc.UserName),
1775                         NewField(FieldUserID, *cc.ID),
1776                         NewField(FieldUserIconID, cc.Icon),
1777                         NewField(FieldUserFlags, cc.Flags),
1778                 ),
1779         )
1780
1781         return res, err
1782 }
1783
1784 func HandleInviteToChat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1785         if !cc.Authorize(accessOpenChat) {
1786                 res = append(res, cc.NewErrReply(t, "You are not allowed to request private chat."))
1787                 return res, err
1788         }
1789
1790         // Client to Invite
1791         targetID := t.GetField(FieldUserID).Data
1792         chatID := t.GetField(FieldChatID).Data
1793
1794         res = append(res,
1795                 *NewTransaction(
1796                         TranInviteToChat,
1797                         &targetID,
1798                         NewField(FieldChatID, chatID),
1799                         NewField(FieldUserName, cc.UserName),
1800                         NewField(FieldUserID, *cc.ID),
1801                 ),
1802         )
1803         res = append(res,
1804                 cc.NewReply(
1805                         t,
1806                         NewField(FieldChatID, chatID),
1807                         NewField(FieldUserName, cc.UserName),
1808                         NewField(FieldUserID, *cc.ID),
1809                         NewField(FieldUserIconID, cc.Icon),
1810                         NewField(FieldUserFlags, cc.Flags),
1811                 ),
1812         )
1813
1814         return res, err
1815 }
1816
1817 func HandleRejectChatInvite(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1818         chatID := t.GetField(FieldChatID).Data
1819         chatInt := binary.BigEndian.Uint32(chatID)
1820
1821         privChat := cc.Server.PrivateChats[chatInt]
1822
1823         resMsg := append(cc.UserName, []byte(" declined invitation to chat")...)
1824
1825         for _, c := range sortedClients(privChat.ClientConn) {
1826                 res = append(res,
1827                         *NewTransaction(
1828                                 TranChatMsg,
1829                                 c.ID,
1830                                 NewField(FieldChatID, chatID),
1831                                 NewField(FieldData, resMsg),
1832                         ),
1833                 )
1834         }
1835
1836         return res, err
1837 }
1838
1839 // HandleJoinChat is sent from a v1.8+ Hotline client when the joins a private chat
1840 // Fields used in the reply:
1841 // * 115        Chat subject
1842 // * 300        User name with info (Optional)
1843 // * 300        (more user names with info)
1844 func HandleJoinChat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1845         chatID := t.GetField(FieldChatID).Data
1846         chatInt := binary.BigEndian.Uint32(chatID)
1847
1848         privChat := cc.Server.PrivateChats[chatInt]
1849
1850         // Send TranNotifyChatChangeUser to current members of the chat to inform of new user
1851         for _, c := range sortedClients(privChat.ClientConn) {
1852                 res = append(res,
1853                         *NewTransaction(
1854                                 TranNotifyChatChangeUser,
1855                                 c.ID,
1856                                 NewField(FieldChatID, chatID),
1857                                 NewField(FieldUserName, cc.UserName),
1858                                 NewField(FieldUserID, *cc.ID),
1859                                 NewField(FieldUserIconID, cc.Icon),
1860                                 NewField(FieldUserFlags, cc.Flags),
1861                         ),
1862                 )
1863         }
1864
1865         privChat.ClientConn[cc.uint16ID()] = cc
1866
1867         replyFields := []Field{NewField(FieldChatSubject, []byte(privChat.Subject))}
1868         for _, c := range sortedClients(privChat.ClientConn) {
1869                 user := User{
1870                         ID:    *c.ID,
1871                         Icon:  c.Icon,
1872                         Flags: c.Flags,
1873                         Name:  string(c.UserName),
1874                 }
1875
1876                 replyFields = append(replyFields, NewField(FieldUsernameWithInfo, user.Payload()))
1877         }
1878
1879         res = append(res, cc.NewReply(t, replyFields...))
1880         return res, err
1881 }
1882
1883 // HandleLeaveChat is sent from a v1.8+ Hotline client when the user exits a private chat
1884 // Fields used in the request:
1885 //   - 114      FieldChatID
1886 //
1887 // Reply is not expected.
1888 func HandleLeaveChat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1889         chatID := t.GetField(FieldChatID).Data
1890         chatInt := binary.BigEndian.Uint32(chatID)
1891
1892         privChat, ok := cc.Server.PrivateChats[chatInt]
1893         if !ok {
1894                 return res, nil
1895         }
1896
1897         delete(privChat.ClientConn, cc.uint16ID())
1898
1899         // Notify members of the private chat that the user has left
1900         for _, c := range sortedClients(privChat.ClientConn) {
1901                 res = append(res,
1902                         *NewTransaction(
1903                                 TranNotifyChatDeleteUser,
1904                                 c.ID,
1905                                 NewField(FieldChatID, chatID),
1906                                 NewField(FieldUserID, *cc.ID),
1907                         ),
1908                 )
1909         }
1910
1911         return res, err
1912 }
1913
1914 // HandleSetChatSubject is sent from a v1.8+ Hotline client when the user sets a private chat subject
1915 // Fields used in the request:
1916 // * 114        Chat ID
1917 // * 115        Chat subject
1918 // Reply is not expected.
1919 func HandleSetChatSubject(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1920         chatID := t.GetField(FieldChatID).Data
1921         chatInt := binary.BigEndian.Uint32(chatID)
1922
1923         privChat := cc.Server.PrivateChats[chatInt]
1924         privChat.Subject = string(t.GetField(FieldChatSubject).Data)
1925
1926         for _, c := range sortedClients(privChat.ClientConn) {
1927                 res = append(res,
1928                         *NewTransaction(
1929                                 TranNotifyChatSubject,
1930                                 c.ID,
1931                                 NewField(FieldChatID, chatID),
1932                                 NewField(FieldChatSubject, t.GetField(FieldChatSubject).Data),
1933                         ),
1934                 )
1935         }
1936
1937         return res, err
1938 }
1939
1940 // HandleMakeAlias makes a file alias using the specified path.
1941 // Fields used in the request:
1942 // 201  File name
1943 // 202  File path
1944 // 212  File new path   Destination path
1945 //
1946 // Fields used in the reply:
1947 // None
1948 func HandleMakeAlias(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1949         if !cc.Authorize(accessMakeAlias) {
1950                 res = append(res, cc.NewErrReply(t, "You are not allowed to make aliases."))
1951                 return res, err
1952         }
1953         fileName := t.GetField(FieldFileName).Data
1954         filePath := t.GetField(FieldFilePath).Data
1955         fileNewPath := t.GetField(FieldFileNewPath).Data
1956
1957         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
1958         if err != nil {
1959                 return res, err
1960         }
1961
1962         fullNewFilePath, err := readPath(cc.Server.Config.FileRoot, fileNewPath, fileName)
1963         if err != nil {
1964                 return res, err
1965         }
1966
1967         cc.logger.Debugw("Make alias", "src", fullFilePath, "dst", fullNewFilePath)
1968
1969         if err := cc.Server.FS.Symlink(fullFilePath, fullNewFilePath); err != nil {
1970                 res = append(res, cc.NewErrReply(t, "Error creating alias"))
1971                 return res, nil
1972         }
1973
1974         res = append(res, cc.NewReply(t))
1975         return res, err
1976 }
1977
1978 // HandleDownloadBanner handles requests for a new banner from the server
1979 // Fields used in the request:
1980 // None
1981 // Fields used in the reply:
1982 // 107  FieldRefNum                     Used later for transfer
1983 // 108  FieldTransferSize       Size of data to be downloaded
1984 func HandleDownloadBanner(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1985         fi, err := cc.Server.FS.Stat(filepath.Join(cc.Server.ConfigDir, cc.Server.Config.BannerFile))
1986         if err != nil {
1987                 return res, err
1988         }
1989
1990         ft := cc.newFileTransfer(bannerDownload, []byte{}, []byte{}, make([]byte, 4))
1991
1992         binary.BigEndian.PutUint32(ft.TransferSize, uint32(fi.Size()))
1993
1994         res = append(res, cc.NewReply(t,
1995                 NewField(FieldRefNum, ft.refNum[:]),
1996                 NewField(FieldTransferSize, ft.TransferSize),
1997         ))
1998
1999         return res, err
2000 }