git.r.bdr.sh - rbdr/mobius/blob - hotline/transaction_handlers.go

   1 package hotline
   2
   3 import (
   4         "bufio"
   5         "bytes"
   6         "encoding/binary"
   7         "errors"
   8         "fmt"
   9         "gopkg.in/yaml.v3"
  10         "io"
  11         "math/big"
  12         "os"
  13         "path"
  14         "path/filepath"
  15         "sort"
  16         "strings"
  17         "time"
  18 )
  19
  20 type HandlerFunc func(*ClientConn, *Transaction) ([]Transaction, error)
  21
  22 type TransactionType struct {
  23         Handler        HandlerFunc // function for handling the transaction type
  24         Name           string      // Name of transaction as it will appear in logging
  25         RequiredFields []requiredField
  26 }
  27
  28 var TransactionHandlers = map[uint16]TransactionType{
  29         // Server initiated
  30         TranChatMsg: {
  31                 Name: "TranChatMsg",
  32         },
  33         // Server initiated
  34         TranNotifyChangeUser: {
  35                 Name: "TranNotifyChangeUser",
  36         },
  37         TranError: {
  38                 Name: "TranError",
  39         },
  40         TranShowAgreement: {
  41                 Name: "TranShowAgreement",
  42         },
  43         TranUserAccess: {
  44                 Name: "TranUserAccess",
  45         },
  46         TranNotifyDeleteUser: {
  47                 Name: "TranNotifyDeleteUser",
  48         },
  49         TranAgreed: {
  50                 Name:    "TranAgreed",
  51                 Handler: HandleTranAgreed,
  52         },
  53         TranChatSend: {
  54                 Name:    "TranChatSend",
  55                 Handler: HandleChatSend,
  56                 RequiredFields: []requiredField{
  57                         {
  58                                 ID:     FieldData,
  59                                 minLen: 0,
  60                         },
  61                 },
  62         },
  63         TranDelNewsArt: {
  64                 Name:    "TranDelNewsArt",
  65                 Handler: HandleDelNewsArt,
  66         },
  67         TranDelNewsItem: {
  68                 Name:    "TranDelNewsItem",
  69                 Handler: HandleDelNewsItem,
  70         },
  71         TranDeleteFile: {
  72                 Name:    "TranDeleteFile",
  73                 Handler: HandleDeleteFile,
  74         },
  75         TranDeleteUser: {
  76                 Name:    "TranDeleteUser",
  77                 Handler: HandleDeleteUser,
  78         },
  79         TranDisconnectUser: {
  80                 Name:    "TranDisconnectUser",
  81                 Handler: HandleDisconnectUser,
  82         },
  83         TranDownloadFile: {
  84                 Name:    "TranDownloadFile",
  85                 Handler: HandleDownloadFile,
  86         },
  87         TranDownloadFldr: {
  88                 Name:    "TranDownloadFldr",
  89                 Handler: HandleDownloadFolder,
  90         },
  91         TranGetClientInfoText: {
  92                 Name:    "TranGetClientInfoText",
  93                 Handler: HandleGetClientInfoText,
  94         },
  95         TranGetFileInfo: {
  96                 Name:    "TranGetFileInfo",
  97                 Handler: HandleGetFileInfo,
  98         },
  99         TranGetFileNameList: {
 100                 Name:    "TranGetFileNameList",
 101                 Handler: HandleGetFileNameList,
 102         },
 103         TranGetMsgs: {
 104                 Name:    "TranGetMsgs",
 105                 Handler: HandleGetMsgs,
 106         },
 107         TranGetNewsArtData: {
 108                 Name:    "TranGetNewsArtData",
 109                 Handler: HandleGetNewsArtData,
 110         },
 111         TranGetNewsArtNameList: {
 112                 Name:    "TranGetNewsArtNameList",
 113                 Handler: HandleGetNewsArtNameList,
 114         },
 115         TranGetNewsCatNameList: {
 116                 Name:    "TranGetNewsCatNameList",
 117                 Handler: HandleGetNewsCatNameList,
 118         },
 119         TranGetUser: {
 120                 Name:    "TranGetUser",
 121                 Handler: HandleGetUser,
 122         },
 123         TranGetUserNameList: {
 124                 Name:    "tranHandleGetUserNameList",
 125                 Handler: HandleGetUserNameList,
 126         },
 127         TranInviteNewChat: {
 128                 Name:    "TranInviteNewChat",
 129                 Handler: HandleInviteNewChat,
 130         },
 131         TranInviteToChat: {
 132                 Name:    "TranInviteToChat",
 133                 Handler: HandleInviteToChat,
 134         },
 135         TranJoinChat: {
 136                 Name:    "TranJoinChat",
 137                 Handler: HandleJoinChat,
 138         },
 139         TranKeepAlive: {
 140                 Name:    "TranKeepAlive",
 141                 Handler: HandleKeepAlive,
 142         },
 143         TranLeaveChat: {
 144                 Name:    "TranJoinChat",
 145                 Handler: HandleLeaveChat,
 146         },
 147         TranListUsers: {
 148                 Name:    "TranListUsers",
 149                 Handler: HandleListUsers,
 150         },
 151         TranMoveFile: {
 152                 Name:    "TranMoveFile",
 153                 Handler: HandleMoveFile,
 154         },
 155         TranNewFolder: {
 156                 Name:    "TranNewFolder",
 157                 Handler: HandleNewFolder,
 158         },
 159         TranNewNewsCat: {
 160                 Name:    "TranNewNewsCat",
 161                 Handler: HandleNewNewsCat,
 162         },
 163         TranNewNewsFldr: {
 164                 Name:    "TranNewNewsFldr",
 165                 Handler: HandleNewNewsFldr,
 166         },
 167         TranNewUser: {
 168                 Name:    "TranNewUser",
 169                 Handler: HandleNewUser,
 170         },
 171         TranUpdateUser: {
 172                 Name:    "TranUpdateUser",
 173                 Handler: HandleUpdateUser,
 174         },
 175         TranOldPostNews: {
 176                 Name:    "TranOldPostNews",
 177                 Handler: HandleTranOldPostNews,
 178         },
 179         TranPostNewsArt: {
 180                 Name:    "TranPostNewsArt",
 181                 Handler: HandlePostNewsArt,
 182         },
 183         TranRejectChatInvite: {
 184                 Name:    "TranRejectChatInvite",
 185                 Handler: HandleRejectChatInvite,
 186         },
 187         TranSendInstantMsg: {
 188                 Name:    "TranSendInstantMsg",
 189                 Handler: HandleSendInstantMsg,
 190                 RequiredFields: []requiredField{
 191                         {
 192                                 ID:     FieldData,
 193                                 minLen: 0,
 194                         },
 195                         {
 196                                 ID: FieldUserID,
 197                         },
 198                 },
 199         },
 200         TranSetChatSubject: {
 201                 Name:    "TranSetChatSubject",
 202                 Handler: HandleSetChatSubject,
 203         },
 204         TranMakeFileAlias: {
 205                 Name:    "TranMakeFileAlias",
 206                 Handler: HandleMakeAlias,
 207                 RequiredFields: []requiredField{
 208                         {ID: FieldFileName, minLen: 1},
 209                         {ID: FieldFilePath, minLen: 1},
 210                         {ID: FieldFileNewPath, minLen: 1},
 211                 },
 212         },
 213         TranSetClientUserInfo: {
 214                 Name:    "TranSetClientUserInfo",
 215                 Handler: HandleSetClientUserInfo,
 216         },
 217         TranSetFileInfo: {
 218                 Name:    "TranSetFileInfo",
 219                 Handler: HandleSetFileInfo,
 220         },
 221         TranSetUser: {
 222                 Name:    "TranSetUser",
 223                 Handler: HandleSetUser,
 224         },
 225         TranUploadFile: {
 226                 Name:    "TranUploadFile",
 227                 Handler: HandleUploadFile,
 228         },
 229         TranUploadFldr: {
 230                 Name:    "TranUploadFldr",
 231                 Handler: HandleUploadFolder,
 232         },
 233         TranUserBroadcast: {
 234                 Name:    "TranUserBroadcast",
 235                 Handler: HandleUserBroadcast,
 236         },
 237         TranDownloadBanner: {
 238                 Name:    "TranDownloadBanner",
 239                 Handler: HandleDownloadBanner,
 240         },
 241 }
 242
 243 func HandleChatSend(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 244         if !cc.Authorize(accessSendChat) {
 245                 res = append(res, cc.NewErrReply(t, "You are not allowed to participate in chat."))
 246                 return res, err
 247         }
 248
 249         // Truncate long usernames
 250         trunc := fmt.Sprintf("%13s", cc.UserName)
 251         formattedMsg := fmt.Sprintf("\r%.14s:  %s", trunc, t.GetField(FieldData).Data)
 252
 253         // By holding the option key, Hotline chat allows users to send /me formatted messages like:
 254         // *** Halcyon does stuff
 255         // This is indicated by the presence of the optional field FieldChatOptions set to a value of 1.
 256         // Most clients do not send this option for normal chat messages.
 257         if t.GetField(FieldChatOptions).Data != nil && bytes.Equal(t.GetField(FieldChatOptions).Data, []byte{0, 1}) {
 258                 formattedMsg = fmt.Sprintf("\r*** %s %s", cc.UserName, t.GetField(FieldData).Data)
 259         }
 260
 261         // The ChatID field is used to identify messages as belonging to a private chat.
 262         // All clients *except* Frogblast omit this field for public chat, but Frogblast sends a value of 00 00 00 00.
 263         chatID := t.GetField(FieldChatID).Data
 264         if chatID != nil && !bytes.Equal([]byte{0, 0, 0, 0}, chatID) {
 265                 chatInt := binary.BigEndian.Uint32(chatID)
 266                 privChat := cc.Server.PrivateChats[chatInt]
 267
 268                 clients := sortedClients(privChat.ClientConn)
 269
 270                 // send the message to all connected clients of the private chat
 271                 for _, c := range clients {
 272                         res = append(res, *NewTransaction(
 273                                 TranChatMsg,
 274                                 c.ID,
 275                                 NewField(FieldChatID, chatID),
 276                                 NewField(FieldData, []byte(formattedMsg)),
 277                         ))
 278                 }
 279                 return res, err
 280         }
 281
 282         for _, c := range sortedClients(cc.Server.Clients) {
 283                 // Filter out clients that do not have the read chat permission
 284                 if c.Authorize(accessReadChat) {
 285                         res = append(res, *NewTransaction(TranChatMsg, c.ID, NewField(FieldData, []byte(formattedMsg))))
 286                 }
 287         }
 288
 289         return res, err
 290 }
 291
 292 // HandleSendInstantMsg sends instant message to the user on the current server.
 293 // Fields used in the request:
 294 //
 295 //      103     User ID
 296 //      113     Options
 297 //              One of the following values:
 298 //              - User message (myOpt_UserMessage = 1)
 299 //              - Refuse message (myOpt_RefuseMessage = 2)
 300 //              - Refuse chat (myOpt_RefuseChat  = 3)
 301 //              - Automatic response (myOpt_AutomaticResponse = 4)"
 302 //      101     Data    Optional
 303 //      214     Quoting message Optional
 304 //
 305 // Fields used in the reply:
 306 // None
 307 func HandleSendInstantMsg(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 308         if !cc.Authorize(accessSendPrivMsg) {
 309                 res = append(res, cc.NewErrReply(t, "You are not allowed to send private messages."))
 310                 return res, errors.New("user is not allowed to send private messages")
 311         }
 312
 313         msg := t.GetField(FieldData)
 314         ID := t.GetField(FieldUserID)
 315
 316         reply := NewTransaction(
 317                 TranServerMsg,
 318                 &ID.Data,
 319                 NewField(FieldData, msg.Data),
 320                 NewField(FieldUserName, cc.UserName),
 321                 NewField(FieldUserID, *cc.ID),
 322                 NewField(FieldOptions, []byte{0, 1}),
 323         )
 324
 325         // Later versions of Hotline include the original message in the FieldQuotingMsg field so
 326         //  the receiving client can display both the received message and what it is in reply to
 327         if t.GetField(FieldQuotingMsg).Data != nil {
 328                 reply.Fields = append(reply.Fields, NewField(FieldQuotingMsg, t.GetField(FieldQuotingMsg).Data))
 329         }
 330
 331         id, err := byteToInt(ID.Data)
 332         if err != nil {
 333                 return res, errors.New("invalid client ID")
 334         }
 335         otherClient, ok := cc.Server.Clients[uint16(id)]
 336         if !ok {
 337                 return res, errors.New("invalid client ID")
 338         }
 339
 340         // Check if target user has "Refuse private messages" flag
 341         flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(otherClient.Flags)))
 342         if flagBitmap.Bit(UserFlagRefusePM) == 1 {
 343                 res = append(res,
 344                         *NewTransaction(
 345                                 TranServerMsg,
 346                                 cc.ID,
 347                                 NewField(FieldData, []byte(string(otherClient.UserName)+" does not accept private messages.")),
 348                                 NewField(FieldUserName, otherClient.UserName),
 349                                 NewField(FieldUserID, *otherClient.ID),
 350                                 NewField(FieldOptions, []byte{0, 2}),
 351                         ),
 352                 )
 353         } else {
 354                 res = append(res, *reply)
 355         }
 356
 357         // Respond with auto reply if other client has it enabled
 358         if len(otherClient.AutoReply) > 0 {
 359                 res = append(res,
 360                         *NewTransaction(
 361                                 TranServerMsg,
 362                                 cc.ID,
 363                                 NewField(FieldData, otherClient.AutoReply),
 364                                 NewField(FieldUserName, otherClient.UserName),
 365                                 NewField(FieldUserID, *otherClient.ID),
 366                                 NewField(FieldOptions, []byte{0, 1}),
 367                         ),
 368                 )
 369         }
 370
 371         res = append(res, cc.NewReply(t))
 372
 373         return res, err
 374 }
 375
 376 func HandleGetFileInfo(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 377         fileName := t.GetField(FieldFileName).Data
 378         filePath := t.GetField(FieldFilePath).Data
 379
 380         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
 381         if err != nil {
 382                 return res, err
 383         }
 384
 385         fw, err := newFileWrapper(cc.Server.FS, fullFilePath, 0)
 386         if err != nil {
 387                 return res, err
 388         }
 389
 390         encodedName, err := txtEncoder.String(fw.name)
 391         if err != nil {
 392                 return res, fmt.Errorf("invalid filepath encoding: %w", err)
 393         }
 394
 395         fields := []Field{
 396                 NewField(FieldFileName, []byte(encodedName)),
 397                 NewField(FieldFileTypeString, fw.ffo.FlatFileInformationFork.friendlyType()),
 398                 NewField(FieldFileCreatorString, fw.ffo.FlatFileInformationFork.friendlyCreator()),
 399                 NewField(FieldFileType, fw.ffo.FlatFileInformationFork.TypeSignature),
 400                 NewField(FieldFileCreateDate, fw.ffo.FlatFileInformationFork.CreateDate),
 401                 NewField(FieldFileModifyDate, fw.ffo.FlatFileInformationFork.ModifyDate),
 402         }
 403
 404         // Include the optional FileComment field if there is a comment.
 405         if len(fw.ffo.FlatFileInformationFork.Comment) != 0 {
 406                 fields = append(fields, NewField(FieldFileComment, fw.ffo.FlatFileInformationFork.Comment))
 407         }
 408
 409         // Include the FileSize field for files.
 410         if !bytes.Equal(fw.ffo.FlatFileInformationFork.TypeSignature, []byte{0x66, 0x6c, 0x64, 0x72}) {
 411                 fields = append(fields, NewField(FieldFileSize, fw.totalSize()))
 412         }
 413
 414         res = append(res, cc.NewReply(t, fields...))
 415         return res, err
 416 }
 417
 418 // HandleSetFileInfo updates a file or folder Name and/or comment from the Get Info window
 419 // Fields used in the request:
 420 // * 201        File Name
 421 // * 202        File path       Optional
 422 // * 211        File new Name   Optional
 423 // * 210        File comment    Optional
 424 // Fields used in the reply:    None
 425 func HandleSetFileInfo(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 426         fileName := t.GetField(FieldFileName).Data
 427         filePath := t.GetField(FieldFilePath).Data
 428
 429         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
 430         if err != nil {
 431                 return res, err
 432         }
 433
 434         fi, err := cc.Server.FS.Stat(fullFilePath)
 435         if err != nil {
 436                 return res, err
 437         }
 438
 439         hlFile, err := newFileWrapper(cc.Server.FS, fullFilePath, 0)
 440         if err != nil {
 441                 return res, err
 442         }
 443         if t.GetField(FieldFileComment).Data != nil {
 444                 switch mode := fi.Mode(); {
 445                 case mode.IsDir():
 446                         if !cc.Authorize(accessSetFolderComment) {
 447                                 res = append(res, cc.NewErrReply(t, "You are not allowed to set comments for folders."))
 448                                 return res, err
 449                         }
 450                 case mode.IsRegular():
 451                         if !cc.Authorize(accessSetFileComment) {
 452                                 res = append(res, cc.NewErrReply(t, "You are not allowed to set comments for files."))
 453                                 return res, err
 454                         }
 455                 }
 456
 457                 if err := hlFile.ffo.FlatFileInformationFork.setComment(t.GetField(FieldFileComment).Data); err != nil {
 458                         return res, err
 459                 }
 460                 w, err := hlFile.infoForkWriter()
 461                 if err != nil {
 462                         return res, err
 463                 }
 464                 _, err = io.Copy(w, &hlFile.ffo.FlatFileInformationFork)
 465                 if err != nil {
 466                         return res, err
 467                 }
 468         }
 469
 470         fullNewFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, t.GetField(FieldFileNewName).Data)
 471         if err != nil {
 472                 return nil, err
 473         }
 474
 475         fileNewName := t.GetField(FieldFileNewName).Data
 476
 477         if fileNewName != nil {
 478                 switch mode := fi.Mode(); {
 479                 case mode.IsDir():
 480                         if !cc.Authorize(accessRenameFolder) {
 481                                 res = append(res, cc.NewErrReply(t, "You are not allowed to rename folders."))
 482                                 return res, err
 483                         }
 484                         err = os.Rename(fullFilePath, fullNewFilePath)
 485                         if os.IsNotExist(err) {
 486                                 res = append(res, cc.NewErrReply(t, "Cannot rename folder "+string(fileName)+" because it does not exist or cannot be found."))
 487                                 return res, err
 488                         }
 489                 case mode.IsRegular():
 490                         if !cc.Authorize(accessRenameFile) {
 491                                 res = append(res, cc.NewErrReply(t, "You are not allowed to rename files."))
 492                                 return res, err
 493                         }
 494                         fileDir, err := readPath(cc.Server.Config.FileRoot, filePath, []byte{})
 495                         if err != nil {
 496                                 return nil, err
 497                         }
 498                         hlFile.name, err = txtDecoder.String(string(fileNewName))
 499                         if err != nil {
 500                                 return res, fmt.Errorf("invalid filepath encoding: %w", err)
 501                         }
 502
 503                         err = hlFile.move(fileDir)
 504                         if os.IsNotExist(err) {
 505                                 res = append(res, cc.NewErrReply(t, "Cannot rename file "+string(fileName)+" because it does not exist or cannot be found."))
 506                                 return res, err
 507                         }
 508                         if err != nil {
 509                                 return res, err
 510                         }
 511                 }
 512         }
 513
 514         res = append(res, cc.NewReply(t))
 515         return res, err
 516 }
 517
 518 // HandleDeleteFile deletes a file or folder
 519 // Fields used in the request:
 520 // * 201        File Name
 521 // * 202        File path
 522 // Fields used in the reply: none
 523 func HandleDeleteFile(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 524         fileName := t.GetField(FieldFileName).Data
 525         filePath := t.GetField(FieldFilePath).Data
 526
 527         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
 528         if err != nil {
 529                 return res, err
 530         }
 531
 532         hlFile, err := newFileWrapper(cc.Server.FS, fullFilePath, 0)
 533         if err != nil {
 534                 return res, err
 535         }
 536
 537         fi, err := hlFile.dataFile()
 538         if err != nil {
 539                 res = append(res, cc.NewErrReply(t, "Cannot delete file "+string(fileName)+" because it does not exist or cannot be found."))
 540                 return res, nil
 541         }
 542
 543         switch mode := fi.Mode(); {
 544         case mode.IsDir():
 545                 if !cc.Authorize(accessDeleteFolder) {
 546                         res = append(res, cc.NewErrReply(t, "You are not allowed to delete folders."))
 547                         return res, err
 548                 }
 549         case mode.IsRegular():
 550                 if !cc.Authorize(accessDeleteFile) {
 551                         res = append(res, cc.NewErrReply(t, "You are not allowed to delete files."))
 552                         return res, err
 553                 }
 554         }
 555
 556         if err := hlFile.delete(); err != nil {
 557                 return res, err
 558         }
 559
 560         res = append(res, cc.NewReply(t))
 561         return res, err
 562 }
 563
 564 // HandleMoveFile moves files or folders. Note: seemingly not documented
 565 func HandleMoveFile(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 566         fileName := string(t.GetField(FieldFileName).Data)
 567
 568         filePath, err := readPath(cc.Server.Config.FileRoot, t.GetField(FieldFilePath).Data, t.GetField(FieldFileName).Data)
 569         if err != nil {
 570                 return res, err
 571         }
 572
 573         fileNewPath, err := readPath(cc.Server.Config.FileRoot, t.GetField(FieldFileNewPath).Data, nil)
 574         if err != nil {
 575                 return res, err
 576         }
 577
 578         cc.logger.Info("Move file", "src", filePath+"/"+fileName, "dst", fileNewPath+"/"+fileName)
 579
 580         hlFile, err := newFileWrapper(cc.Server.FS, filePath, 0)
 581         if err != nil {
 582                 return res, err
 583         }
 584
 585         fi, err := hlFile.dataFile()
 586         if err != nil {
 587                 res = append(res, cc.NewErrReply(t, "Cannot delete file "+fileName+" because it does not exist or cannot be found."))
 588                 return res, err
 589         }
 590         switch mode := fi.Mode(); {
 591         case mode.IsDir():
 592                 if !cc.Authorize(accessMoveFolder) {
 593                         res = append(res, cc.NewErrReply(t, "You are not allowed to move folders."))
 594                         return res, err
 595                 }
 596         case mode.IsRegular():
 597                 if !cc.Authorize(accessMoveFile) {
 598                         res = append(res, cc.NewErrReply(t, "You are not allowed to move files."))
 599                         return res, err
 600                 }
 601         }
 602         if err := hlFile.move(fileNewPath); err != nil {
 603                 return res, err
 604         }
 605         // TODO: handle other possible errors; e.g. fileWrapper delete fails due to fileWrapper permission issue
 606
 607         res = append(res, cc.NewReply(t))
 608         return res, err
 609 }
 610
 611 func HandleNewFolder(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 612         if !cc.Authorize(accessCreateFolder) {
 613                 res = append(res, cc.NewErrReply(t, "You are not allowed to create folders."))
 614                 return res, err
 615         }
 616         folderName := string(t.GetField(FieldFileName).Data)
 617
 618         folderName = path.Join("/", folderName)
 619
 620         var subPath string
 621
 622         // FieldFilePath is only present for nested paths
 623         if t.GetField(FieldFilePath).Data != nil {
 624                 var newFp FilePath
 625                 _, err := newFp.Write(t.GetField(FieldFilePath).Data)
 626                 if err != nil {
 627                         return nil, err
 628                 }
 629
 630                 for _, pathItem := range newFp.Items {
 631                         subPath = filepath.Join("/", subPath, string(pathItem.Name))
 632                 }
 633         }
 634         newFolderPath := path.Join(cc.Server.Config.FileRoot, subPath, folderName)
 635         newFolderPath, err = txtDecoder.String(newFolderPath)
 636         if err != nil {
 637                 return res, fmt.Errorf("invalid filepath encoding: %w", err)
 638         }
 639
 640         // TODO: check path and folder Name lengths
 641
 642         if _, err := cc.Server.FS.Stat(newFolderPath); !os.IsNotExist(err) {
 643                 msg := fmt.Sprintf("Cannot create folder \"%s\" because there is already a file or folder with that Name.", folderName)
 644                 return []Transaction{cc.NewErrReply(t, msg)}, nil
 645         }
 646
 647         if err := cc.Server.FS.Mkdir(newFolderPath, 0777); err != nil {
 648                 msg := fmt.Sprintf("Cannot create folder \"%s\" because an error occurred.", folderName)
 649                 return []Transaction{cc.NewErrReply(t, msg)}, nil
 650         }
 651
 652         res = append(res, cc.NewReply(t))
 653         return res, err
 654 }
 655
 656 func HandleSetUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 657         if !cc.Authorize(accessModifyUser) {
 658                 res = append(res, cc.NewErrReply(t, "You are not allowed to modify accounts."))
 659                 return res, err
 660         }
 661
 662         login := string(encodeString(t.GetField(FieldUserLogin).Data))
 663         userName := string(t.GetField(FieldUserName).Data)
 664
 665         newAccessLvl := t.GetField(FieldUserAccess).Data
 666
 667         account := cc.Server.Accounts[login]
 668         if account == nil {
 669                 return append(res, cc.NewErrReply(t, "Account not found.")), nil
 670         }
 671         account.Name = userName
 672         copy(account.Access[:], newAccessLvl)
 673
 674         // If the password field is cleared in the Hotline edit user UI, the SetUser transaction does
 675         // not include FieldUserPassword
 676         if t.GetField(FieldUserPassword).Data == nil {
 677                 account.Password = hashAndSalt([]byte(""))
 678         }
 679
 680         if !bytes.Equal([]byte{0}, t.GetField(FieldUserPassword).Data) {
 681                 account.Password = hashAndSalt(t.GetField(FieldUserPassword).Data)
 682         }
 683
 684         out, err := yaml.Marshal(&account)
 685         if err != nil {
 686                 return res, err
 687         }
 688         if err := os.WriteFile(filepath.Join(cc.Server.ConfigDir, "Users", login+".yaml"), out, 0666); err != nil {
 689                 return res, err
 690         }
 691
 692         // Notify connected clients logged in as the user of the new access level
 693         for _, c := range cc.Server.Clients {
 694                 if c.Account.Login == login {
 695                         // Note: comment out these two lines to test server-side deny messages
 696                         newT := NewTransaction(TranUserAccess, c.ID, NewField(FieldUserAccess, newAccessLvl))
 697                         res = append(res, *newT)
 698
 699                         flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(c.Flags)))
 700                         if c.Authorize(accessDisconUser) {
 701                                 flagBitmap.SetBit(flagBitmap, UserFlagAdmin, 1)
 702                         } else {
 703                                 flagBitmap.SetBit(flagBitmap, UserFlagAdmin, 0)
 704                         }
 705                         binary.BigEndian.PutUint16(c.Flags, uint16(flagBitmap.Int64()))
 706
 707                         c.Account.Access = account.Access
 708
 709                         cc.sendAll(
 710                                 TranNotifyChangeUser,
 711                                 NewField(FieldUserID, *c.ID),
 712                                 NewField(FieldUserFlags, c.Flags),
 713                                 NewField(FieldUserName, c.UserName),
 714                                 NewField(FieldUserIconID, c.Icon),
 715                         )
 716                 }
 717         }
 718
 719         res = append(res, cc.NewReply(t))
 720         return res, err
 721 }
 722
 723 func HandleGetUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 724         if !cc.Authorize(accessOpenUser) {
 725                 res = append(res, cc.NewErrReply(t, "You are not allowed to view accounts."))
 726                 return res, err
 727         }
 728
 729         account := cc.Server.Accounts[string(t.GetField(FieldUserLogin).Data)]
 730         if account == nil {
 731                 res = append(res, cc.NewErrReply(t, "Account does not exist."))
 732                 return res, err
 733         }
 734
 735         res = append(res, cc.NewReply(t,
 736                 NewField(FieldUserName, []byte(account.Name)),
 737                 NewField(FieldUserLogin, encodeString(t.GetField(FieldUserLogin).Data)),
 738                 NewField(FieldUserPassword, []byte(account.Password)),
 739                 NewField(FieldUserAccess, account.Access[:]),
 740         ))
 741         return res, err
 742 }
 743
 744 func HandleListUsers(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 745         if !cc.Authorize(accessOpenUser) {
 746                 res = append(res, cc.NewErrReply(t, "You are not allowed to view accounts."))
 747                 return res, err
 748         }
 749
 750         var userFields []Field
 751         for _, acc := range cc.Server.Accounts {
 752                 b, err := io.ReadAll(acc)
 753                 if err != nil {
 754                         return res, err
 755                 }
 756
 757                 userFields = append(userFields, NewField(FieldData, b))
 758         }
 759
 760         res = append(res, cc.NewReply(t, userFields...))
 761         return res, err
 762 }
 763
 764 // HandleUpdateUser is used by the v1.5+ multi-user editor to perform account editing for multiple users at a time.
 765 // An update can be a mix of these actions:
 766 // * Create user
 767 // * Delete user
 768 // * Modify user (including renaming the account login)
 769 //
 770 // The Transaction sent by the client includes one data field per user that was modified.  This data field in turn
 771 // contains another data field encoded in its payload with a varying number of sub fields depending on which action is
 772 // performed.  This seems to be the only place in the Hotline protocol where a data field contains another data field.
 773 func HandleUpdateUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 774         for _, field := range t.Fields {
 775
 776                 var subFields []Field
 777
 778                 // Create a new scanner for parsing incoming bytes into transaction tokens
 779                 scanner := bufio.NewScanner(bytes.NewReader(field.Data[2:]))
 780                 scanner.Split(fieldScanner)
 781
 782                 for i := 0; i < int(binary.BigEndian.Uint16(field.Data[0:2])); i++ {
 783                         scanner.Scan()
 784
 785                         var field Field
 786                         if _, err := field.Write(scanner.Bytes()); err != nil {
 787                                 return res, fmt.Errorf("error reading field: %w", err)
 788                         }
 789                         subFields = append(subFields, field)
 790                 }
 791
 792                 // If there's only one subfield, that indicates this is a delete operation for the login in FieldData
 793                 if len(subFields) == 1 {
 794                         if !cc.Authorize(accessDeleteUser) {
 795                                 res = append(res, cc.NewErrReply(t, "You are not allowed to delete accounts."))
 796                                 return res, err
 797                         }
 798
 799                         login := string(encodeString(getField(FieldData, &subFields).Data))
 800                         cc.logger.Info("DeleteUser", "login", login)
 801
 802                         if err := cc.Server.DeleteUser(login); err != nil {
 803                                 return res, err
 804                         }
 805                         continue
 806                 }
 807
 808                 // login of the account to update
 809                 var accountToUpdate, loginToRename string
 810
 811                 // If FieldData is included, this is a rename operation where FieldData contains the login of the existing
 812                 // account and FieldUserLogin contains the new login.
 813                 if getField(FieldData, &subFields) != nil {
 814                         loginToRename = string(encodeString(getField(FieldData, &subFields).Data))
 815                 }
 816                 userLogin := string(encodeString(getField(FieldUserLogin, &subFields).Data))
 817                 if loginToRename != "" {
 818                         accountToUpdate = loginToRename
 819                 } else {
 820                         accountToUpdate = userLogin
 821                 }
 822
 823                 // Check if accountToUpdate has an existing account.  If so, we know we are updating an existing user.
 824                 if acc, ok := cc.Server.Accounts[accountToUpdate]; ok {
 825                         if loginToRename != "" {
 826                                 cc.logger.Info("RenameUser", "prevLogin", accountToUpdate, "newLogin", userLogin)
 827                         } else {
 828                                 cc.logger.Info("UpdateUser", "login", accountToUpdate)
 829                         }
 830
 831                         // account exists, so this is an update action
 832                         if !cc.Authorize(accessModifyUser) {
 833                                 res = append(res, cc.NewErrReply(t, "You are not allowed to modify accounts."))
 834                                 return res, nil
 835                         }
 836
 837                         // This part is a bit tricky. There are three possibilities:
 838                         // 1) The transaction is intended to update the password.
 839                         //        In this case, FieldUserPassword is sent with the new password.
 840                         // 2) The transaction is intended to remove the password.
 841                         //    In this case, FieldUserPassword is not sent.
 842                         // 3) The transaction updates the users access bits, but not the password.
 843                         //    In this case, FieldUserPassword is sent with zero as the only byte.
 844                         if getField(FieldUserPassword, &subFields) != nil {
 845                                 newPass := getField(FieldUserPassword, &subFields).Data
 846                                 if !bytes.Equal([]byte{0}, newPass) {
 847                                         acc.Password = hashAndSalt(newPass)
 848                                 }
 849                         } else {
 850                                 acc.Password = hashAndSalt([]byte(""))
 851                         }
 852
 853                         if getField(FieldUserAccess, &subFields) != nil {
 854                                 copy(acc.Access[:], getField(FieldUserAccess, &subFields).Data)
 855                         }
 856
 857                         err = cc.Server.UpdateUser(
 858                                 string(encodeString(getField(FieldData, &subFields).Data)),
 859                                 string(encodeString(getField(FieldUserLogin, &subFields).Data)),
 860                                 string(getField(FieldUserName, &subFields).Data),
 861                                 acc.Password,
 862                                 acc.Access,
 863                         )
 864                         if err != nil {
 865                                 return res, err
 866                         }
 867                 } else {
 868                         if !cc.Authorize(accessCreateUser) {
 869                                 res = append(res, cc.NewErrReply(t, "You are not allowed to create new accounts."))
 870                                 return res, nil
 871                         }
 872
 873                         cc.logger.Info("CreateUser", "login", userLogin)
 874
 875                         newAccess := accessBitmap{}
 876                         copy(newAccess[:], getField(FieldUserAccess, &subFields).Data)
 877
 878                         // Prevent account from creating new account with greater permission
 879                         for i := 0; i < 64; i++ {
 880                                 if newAccess.IsSet(i) {
 881                                         if !cc.Authorize(i) {
 882                                                 return append(res, cc.NewErrReply(t, "Cannot create account with more access than yourself.")), nil
 883                                         }
 884                                 }
 885                         }
 886
 887                         err = cc.Server.NewUser(userLogin, string(getField(FieldUserName, &subFields).Data), string(getField(FieldUserPassword, &subFields).Data), newAccess)
 888                         if err != nil {
 889                                 return append(res, cc.NewErrReply(t, "Cannot create account because there is already an account with that login.")), nil
 890                         }
 891                 }
 892         }
 893
 894         res = append(res, cc.NewReply(t))
 895         return res, err
 896 }
 897
 898 // HandleNewUser creates a new user account
 899 func HandleNewUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 900         if !cc.Authorize(accessCreateUser) {
 901                 res = append(res, cc.NewErrReply(t, "You are not allowed to create new accounts."))
 902                 return res, err
 903         }
 904
 905         login := string(encodeString(t.GetField(FieldUserLogin).Data))
 906
 907         // If the account already dataFile, reply with an error
 908         if _, ok := cc.Server.Accounts[login]; ok {
 909                 res = append(res, cc.NewErrReply(t, "Cannot create account "+login+" because there is already an account with that login."))
 910                 return res, err
 911         }
 912
 913         newAccess := accessBitmap{}
 914         copy(newAccess[:], t.GetField(FieldUserAccess).Data)
 915
 916         // Prevent account from creating new account with greater permission
 917         for i := 0; i < 64; i++ {
 918                 if newAccess.IsSet(i) {
 919                         if !cc.Authorize(i) {
 920                                 res = append(res, cc.NewErrReply(t, "Cannot create account with more access than yourself."))
 921                                 return res, err
 922                         }
 923                 }
 924         }
 925
 926         if err := cc.Server.NewUser(login, string(t.GetField(FieldUserName).Data), string(t.GetField(FieldUserPassword).Data), newAccess); err != nil {
 927                 res = append(res, cc.NewErrReply(t, "Cannot create account because there is already an account with that login."))
 928                 return res, err
 929         }
 930
 931         res = append(res, cc.NewReply(t))
 932         return res, err
 933 }
 934
 935 func HandleDeleteUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 936         if !cc.Authorize(accessDeleteUser) {
 937                 res = append(res, cc.NewErrReply(t, "You are not allowed to delete accounts."))
 938                 return res, nil
 939         }
 940
 941         login := string(encodeString(t.GetField(FieldUserLogin).Data))
 942
 943         if err := cc.Server.DeleteUser(login); err != nil {
 944                 return res, err
 945         }
 946
 947         res = append(res, cc.NewReply(t))
 948         return res, err
 949 }
 950
 951 // HandleUserBroadcast sends an Administrator Message to all connected clients of the server
 952 func HandleUserBroadcast(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 953         if !cc.Authorize(accessBroadcast) {
 954                 res = append(res, cc.NewErrReply(t, "You are not allowed to send broadcast messages."))
 955                 return res, err
 956         }
 957
 958         cc.sendAll(
 959                 TranServerMsg,
 960                 NewField(FieldData, t.GetField(TranGetMsgs).Data),
 961                 NewField(FieldChatOptions, []byte{0}),
 962         )
 963
 964         res = append(res, cc.NewReply(t))
 965         return res, err
 966 }
 967
 968 // HandleGetClientInfoText returns user information for the specific user.
 969 //
 970 // Fields used in the request:
 971 // 103  User ID
 972 //
 973 // Fields used in the reply:
 974 // 102  User Name
 975 // 101  Data            User info text string
 976 func HandleGetClientInfoText(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 977         if !cc.Authorize(accessGetClientInfo) {
 978                 res = append(res, cc.NewErrReply(t, "You are not allowed to get client info."))
 979                 return res, err
 980         }
 981
 982         clientID, _ := byteToInt(t.GetField(FieldUserID).Data)
 983
 984         clientConn := cc.Server.Clients[uint16(clientID)]
 985         if clientConn == nil {
 986                 return append(res, cc.NewErrReply(t, "User not found.")), err
 987         }
 988
 989         res = append(res, cc.NewReply(t,
 990                 NewField(FieldData, []byte(clientConn.String())),
 991                 NewField(FieldUserName, clientConn.UserName),
 992         ))
 993         return res, err
 994 }
 995
 996 func HandleGetUserNameList(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 997         res = append(res, cc.NewReply(t, cc.Server.connectedUsers()...))
 998
 999         return res, err
1000 }
1001
1002 func HandleTranAgreed(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1003         if t.GetField(FieldUserName).Data != nil {
1004                 if cc.Authorize(accessAnyName) {
1005                         cc.UserName = t.GetField(FieldUserName).Data
1006                 } else {
1007                         cc.UserName = []byte(cc.Account.Name)
1008                 }
1009         }
1010
1011         cc.Icon = t.GetField(FieldUserIconID).Data
1012
1013         cc.logger = cc.logger.With("Name", string(cc.UserName))
1014         cc.logger.Info("Login successful", "clientVersion", fmt.Sprintf("%v", func() int { i, _ := byteToInt(cc.Version); return i }()))
1015
1016         options := t.GetField(FieldOptions).Data
1017         optBitmap := big.NewInt(int64(binary.BigEndian.Uint16(options)))
1018
1019         flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(cc.Flags)))
1020
1021         // Check refuse private PM option
1022         if optBitmap.Bit(UserOptRefusePM) == 1 {
1023                 flagBitmap.SetBit(flagBitmap, UserFlagRefusePM, 1)
1024                 binary.BigEndian.PutUint16(cc.Flags, uint16(flagBitmap.Int64()))
1025         }
1026
1027         // Check refuse private chat option
1028         if optBitmap.Bit(UserOptRefuseChat) == 1 {
1029                 flagBitmap.SetBit(flagBitmap, UserFlagRefusePChat, 1)
1030                 binary.BigEndian.PutUint16(cc.Flags, uint16(flagBitmap.Int64()))
1031         }
1032
1033         // Check auto response
1034         if optBitmap.Bit(UserOptAutoResponse) == 1 {
1035                 cc.AutoReply = t.GetField(FieldAutomaticResponse).Data
1036         } else {
1037                 cc.AutoReply = []byte{}
1038         }
1039
1040         trans := cc.notifyOthers(
1041                 *NewTransaction(
1042                         TranNotifyChangeUser, nil,
1043                         NewField(FieldUserName, cc.UserName),
1044                         NewField(FieldUserID, *cc.ID),
1045                         NewField(FieldUserIconID, cc.Icon),
1046                         NewField(FieldUserFlags, cc.Flags),
1047                 ),
1048         )
1049         res = append(res, trans...)
1050
1051         if cc.Server.Config.BannerFile != "" {
1052                 res = append(res, *NewTransaction(TranServerBanner, cc.ID, NewField(FieldBannerType, []byte("JPEG"))))
1053         }
1054
1055         res = append(res, cc.NewReply(t))
1056
1057         return res, err
1058 }
1059
1060 // HandleTranOldPostNews updates the flat news
1061 // Fields used in this request:
1062 // 101  Data
1063 func HandleTranOldPostNews(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1064         if !cc.Authorize(accessNewsPostArt) {
1065                 res = append(res, cc.NewErrReply(t, "You are not allowed to post news."))
1066                 return res, err
1067         }
1068
1069         cc.Server.flatNewsMux.Lock()
1070         defer cc.Server.flatNewsMux.Unlock()
1071
1072         newsDateTemplate := defaultNewsDateFormat
1073         if cc.Server.Config.NewsDateFormat != "" {
1074                 newsDateTemplate = cc.Server.Config.NewsDateFormat
1075         }
1076
1077         newsTemplate := defaultNewsTemplate
1078         if cc.Server.Config.NewsDelimiter != "" {
1079                 newsTemplate = cc.Server.Config.NewsDelimiter
1080         }
1081
1082         newsPost := fmt.Sprintf(newsTemplate+"\r", cc.UserName, time.Now().Format(newsDateTemplate), t.GetField(FieldData).Data)
1083         newsPost = strings.ReplaceAll(newsPost, "\n", "\r")
1084
1085         // update news in memory
1086         cc.Server.FlatNews = append([]byte(newsPost), cc.Server.FlatNews...)
1087
1088         // update news on disk
1089         if err := cc.Server.FS.WriteFile(filepath.Join(cc.Server.ConfigDir, "MessageBoard.txt"), cc.Server.FlatNews, 0644); err != nil {
1090                 return res, err
1091         }
1092
1093         // Notify all clients of updated news
1094         cc.sendAll(
1095                 TranNewMsg,
1096                 NewField(FieldData, []byte(newsPost)),
1097         )
1098
1099         res = append(res, cc.NewReply(t))
1100         return res, err
1101 }
1102
1103 func HandleDisconnectUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1104         if !cc.Authorize(accessDisconUser) {
1105                 res = append(res, cc.NewErrReply(t, "You are not allowed to disconnect users."))
1106                 return res, err
1107         }
1108
1109         clientConn := cc.Server.Clients[binary.BigEndian.Uint16(t.GetField(FieldUserID).Data)]
1110
1111         if clientConn.Authorize(accessCannotBeDiscon) {
1112                 res = append(res, cc.NewErrReply(t, clientConn.Account.Login+" is not allowed to be disconnected."))
1113                 return res, err
1114         }
1115
1116         // If FieldOptions is set, then the client IP is banned in addition to disconnected.
1117         // 00 01 = temporary ban
1118         // 00 02 = permanent ban
1119         if t.GetField(FieldOptions).Data != nil {
1120                 switch t.GetField(FieldOptions).Data[1] {
1121                 case 1:
1122                         // send message: "You are temporarily banned on this server"
1123                         cc.logger.Info("Disconnect & temporarily ban " + string(clientConn.UserName))
1124
1125                         res = append(res, *NewTransaction(
1126                                 TranServerMsg,
1127                                 clientConn.ID,
1128                                 NewField(FieldData, []byte("You are temporarily banned on this server")),
1129                                 NewField(FieldChatOptions, []byte{0, 0}),
1130                         ))
1131
1132                         banUntil := time.Now().Add(tempBanDuration)
1133                         cc.Server.banList[strings.Split(clientConn.RemoteAddr, ":")[0]] = &banUntil
1134                 case 2:
1135                         // send message: "You are permanently banned on this server"
1136                         cc.logger.Info("Disconnect & ban " + string(clientConn.UserName))
1137
1138                         res = append(res, *NewTransaction(
1139                                 TranServerMsg,
1140                                 clientConn.ID,
1141                                 NewField(FieldData, []byte("You are permanently banned on this server")),
1142                                 NewField(FieldChatOptions, []byte{0, 0}),
1143                         ))
1144
1145                         cc.Server.banList[strings.Split(clientConn.RemoteAddr, ":")[0]] = nil
1146                 }
1147
1148                 err := cc.Server.writeBanList()
1149                 if err != nil {
1150                         return res, err
1151                 }
1152         }
1153
1154         // TODO: remove this awful hack
1155         go func() {
1156                 time.Sleep(1 * time.Second)
1157                 clientConn.Disconnect()
1158         }()
1159
1160         return append(res, cc.NewReply(t)), err
1161 }
1162
1163 // HandleGetNewsCatNameList returns a list of news categories for a path
1164 // Fields used in the request:
1165 // 325  News path       (Optional)
1166 func HandleGetNewsCatNameList(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1167         if !cc.Authorize(accessNewsReadArt) {
1168                 res = append(res, cc.NewErrReply(t, "You are not allowed to read news."))
1169                 return res, err
1170         }
1171
1172         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1173         cats := cc.Server.GetNewsCatByPath(pathStrs)
1174
1175         // To store the keys in slice in sorted order
1176         keys := make([]string, len(cats))
1177         i := 0
1178         for k := range cats {
1179                 keys[i] = k
1180                 i++
1181         }
1182         sort.Strings(keys)
1183
1184         var fieldData []Field
1185         for _, k := range keys {
1186                 cat := cats[k]
1187                 b, _ := cat.MarshalBinary()
1188                 fieldData = append(fieldData, NewField(
1189                         FieldNewsCatListData15,
1190                         b,
1191                 ))
1192         }
1193
1194         res = append(res, cc.NewReply(t, fieldData...))
1195         return res, err
1196 }
1197
1198 func HandleNewNewsCat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1199         if !cc.Authorize(accessNewsCreateCat) {
1200                 res = append(res, cc.NewErrReply(t, "You are not allowed to create news categories."))
1201                 return res, err
1202         }
1203
1204         name := string(t.GetField(FieldNewsCatName).Data)
1205         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1206
1207         cats := cc.Server.GetNewsCatByPath(pathStrs)
1208         cats[name] = NewsCategoryListData15{
1209                 Name:     name,
1210                 Type:     [2]byte{0, 3},
1211                 Articles: map[uint32]*NewsArtData{},
1212                 SubCats:  make(map[string]NewsCategoryListData15),
1213         }
1214
1215         if err := cc.Server.writeThreadedNews(); err != nil {
1216                 return res, err
1217         }
1218         res = append(res, cc.NewReply(t))
1219         return res, err
1220 }
1221
1222 // Fields used in the request:
1223 // 322  News category Name
1224 // 325  News path
1225 func HandleNewNewsFldr(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1226         if !cc.Authorize(accessNewsCreateFldr) {
1227                 res = append(res, cc.NewErrReply(t, "You are not allowed to create news folders."))
1228                 return res, err
1229         }
1230
1231         name := string(t.GetField(FieldFileName).Data)
1232         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1233
1234         cats := cc.Server.GetNewsCatByPath(pathStrs)
1235         cats[name] = NewsCategoryListData15{
1236                 Name:     name,
1237                 Type:     [2]byte{0, 2},
1238                 Articles: map[uint32]*NewsArtData{},
1239                 SubCats:  make(map[string]NewsCategoryListData15),
1240         }
1241         if err := cc.Server.writeThreadedNews(); err != nil {
1242                 return res, err
1243         }
1244         res = append(res, cc.NewReply(t))
1245         return res, err
1246 }
1247
1248 // HandleGetNewsArtData gets the list of article names at the specified news path.
1249
1250 // Fields used in the request:
1251 // 325  News path       Optional
1252
1253 // Fields used in the reply:
1254 // 321  News article list data  Optional
1255 func HandleGetNewsArtNameList(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1256         if !cc.Authorize(accessNewsReadArt) {
1257                 res = append(res, cc.NewErrReply(t, "You are not allowed to read news."))
1258                 return res, err
1259         }
1260         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1261
1262         var cat NewsCategoryListData15
1263         cats := cc.Server.ThreadedNews.Categories
1264
1265         for _, fp := range pathStrs {
1266                 cat = cats[fp]
1267                 cats = cats[fp].SubCats
1268         }
1269
1270         nald := cat.GetNewsArtListData()
1271
1272         b, err := io.ReadAll(&nald)
1273         if err != nil {
1274
1275         }
1276
1277         res = append(res, cc.NewReply(t, NewField(FieldNewsArtListData, b)))
1278         return res, err
1279 }
1280
1281 // HandleGetNewsArtData requests information about the specific news article.
1282 // Fields used in the request:
1283 //
1284 // Request fields
1285 // 325  News path
1286 // 326  News article ID
1287 // 327  News article data flavor
1288 //
1289 // Fields used in the reply:
1290 // 328  News article title
1291 // 329  News article poster
1292 // 330  News article date
1293 // 331  Previous article ID
1294 // 332  Next article ID
1295 // 335  Parent article ID
1296 // 336  First child article ID
1297 // 327  News article data flavor        "Should be “text/plain”
1298 // 333  News article data       Optional (if data flavor is “text/plain”)
1299 func HandleGetNewsArtData(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1300         if !cc.Authorize(accessNewsReadArt) {
1301                 res = append(res, cc.NewErrReply(t, "You are not allowed to read news."))
1302                 return res, err
1303         }
1304
1305         var cat NewsCategoryListData15
1306         cats := cc.Server.ThreadedNews.Categories
1307
1308         for _, fp := range ReadNewsPath(t.GetField(FieldNewsPath).Data) {
1309                 cat = cats[fp]
1310                 cats = cats[fp].SubCats
1311         }
1312
1313         // The official Hotline clients will send the article ID as 2 bytes if possible, but
1314         // some third party clients such as Frogblast and Heildrun will always send 4 bytes
1315         convertedID, err := byteToInt(t.GetField(FieldNewsArtID).Data)
1316         if err != nil {
1317                 return res, err
1318         }
1319
1320         art := cat.Articles[uint32(convertedID)]
1321         if art == nil {
1322                 res = append(res, cc.NewReply(t))
1323                 return res, err
1324         }
1325
1326         res = append(res, cc.NewReply(t,
1327                 NewField(FieldNewsArtTitle, []byte(art.Title)),
1328                 NewField(FieldNewsArtPoster, []byte(art.Poster)),
1329                 NewField(FieldNewsArtDate, art.Date[:]),
1330                 NewField(FieldNewsArtPrevArt, art.PrevArt[:]),
1331                 NewField(FieldNewsArtNextArt, art.NextArt[:]),
1332                 NewField(FieldNewsArtParentArt, art.ParentArt[:]),
1333                 NewField(FieldNewsArt1stChildArt, art.FirstChildArt[:]),
1334                 NewField(FieldNewsArtDataFlav, []byte("text/plain")),
1335                 NewField(FieldNewsArtData, []byte(art.Data)),
1336         ))
1337         return res, err
1338 }
1339
1340 // HandleDelNewsItem deletes an existing threaded news folder or category from the server.
1341 // Fields used in the request:
1342 // 325  News path
1343 // Fields used in the reply:
1344 // None
1345 func HandleDelNewsItem(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1346         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1347
1348         cats := cc.Server.ThreadedNews.Categories
1349         delName := pathStrs[len(pathStrs)-1]
1350         if len(pathStrs) > 1 {
1351                 for _, fp := range pathStrs[0 : len(pathStrs)-1] {
1352                         cats = cats[fp].SubCats
1353                 }
1354         }
1355
1356         if cats[delName].Type == [2]byte{0, 3} {
1357                 if !cc.Authorize(accessNewsDeleteCat) {
1358                         return append(res, cc.NewErrReply(t, "You are not allowed to delete news categories.")), nil
1359                 }
1360         } else {
1361                 if !cc.Authorize(accessNewsDeleteFldr) {
1362                         return append(res, cc.NewErrReply(t, "You are not allowed to delete news folders.")), nil
1363                 }
1364         }
1365
1366         delete(cats, delName)
1367
1368         if err := cc.Server.writeThreadedNews(); err != nil {
1369                 return res, err
1370         }
1371
1372         return append(res, cc.NewReply(t)), nil
1373 }
1374
1375 func HandleDelNewsArt(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1376         if !cc.Authorize(accessNewsDeleteArt) {
1377                 res = append(res, cc.NewErrReply(t, "You are not allowed to delete news articles."))
1378                 return res, err
1379         }
1380
1381         // Request Fields
1382         // 325  News path
1383         // 326  News article ID
1384         // 337  News article – recursive delete       Delete child articles (1) or not (0)
1385         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1386         ID, err := byteToInt(t.GetField(FieldNewsArtID).Data)
1387         if err != nil {
1388                 return res, err
1389         }
1390
1391         // TODO: Delete recursive
1392         cats := cc.Server.GetNewsCatByPath(pathStrs[:len(pathStrs)-1])
1393
1394         catName := pathStrs[len(pathStrs)-1]
1395         cat := cats[catName]
1396
1397         delete(cat.Articles, uint32(ID))
1398
1399         cats[catName] = cat
1400         if err := cc.Server.writeThreadedNews(); err != nil {
1401                 return res, err
1402         }
1403
1404         res = append(res, cc.NewReply(t))
1405         return res, err
1406 }
1407
1408 // Request fields
1409 // 325  News path
1410 // 326  News article ID                                                 ID of the parent article?
1411 // 328  News article title
1412 // 334  News article flags
1413 // 327  News article data flavor                Currently “text/plain”
1414 // 333  News article data
1415 func HandlePostNewsArt(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1416         if !cc.Authorize(accessNewsPostArt) {
1417                 res = append(res, cc.NewErrReply(t, "You are not allowed to post news articles."))
1418                 return res, err
1419         }
1420
1421         pathStrs := ReadNewsPath(t.GetField(FieldNewsPath).Data)
1422         cats := cc.Server.GetNewsCatByPath(pathStrs[:len(pathStrs)-1])
1423
1424         catName := pathStrs[len(pathStrs)-1]
1425         cat := cats[catName]
1426
1427         artID, err := byteToInt(t.GetField(FieldNewsArtID).Data)
1428         if err != nil {
1429                 return res, err
1430         }
1431         convertedArtID := uint32(artID)
1432         bs := make([]byte, 4)
1433         binary.BigEndian.PutUint32(bs, convertedArtID)
1434
1435         newArt := NewsArtData{
1436                 Title:         string(t.GetField(FieldNewsArtTitle).Data),
1437                 Poster:        string(cc.UserName),
1438                 Date:          toHotlineTime(time.Now()),
1439                 PrevArt:       [4]byte{},
1440                 NextArt:       [4]byte{},
1441                 ParentArt:     [4]byte(bs),
1442                 FirstChildArt: [4]byte{},
1443                 DataFlav:      []byte("text/plain"),
1444                 Data:          string(t.GetField(FieldNewsArtData).Data),
1445         }
1446
1447         var keys []int
1448         for k := range cat.Articles {
1449                 keys = append(keys, int(k))
1450         }
1451
1452         nextID := uint32(1)
1453         if len(keys) > 0 {
1454                 sort.Ints(keys)
1455                 prevID := uint32(keys[len(keys)-1])
1456                 nextID = prevID + 1
1457
1458                 binary.BigEndian.PutUint32(newArt.PrevArt[:], prevID)
1459
1460                 // Set next article ID
1461                 binary.BigEndian.PutUint32(cat.Articles[prevID].NextArt[:], nextID)
1462         }
1463
1464         // Update parent article with first child reply
1465         parentID := convertedArtID
1466         if parentID != 0 {
1467                 parentArt := cat.Articles[parentID]
1468
1469                 if parentArt.FirstChildArt == [4]byte{0, 0, 0, 0} {
1470                         binary.BigEndian.PutUint32(parentArt.FirstChildArt[:], nextID)
1471                 }
1472         }
1473
1474         cat.Articles[nextID] = &newArt
1475
1476         cats[catName] = cat
1477         if err := cc.Server.writeThreadedNews(); err != nil {
1478                 return res, err
1479         }
1480
1481         res = append(res, cc.NewReply(t))
1482         return res, err
1483 }
1484
1485 // HandleGetMsgs returns the flat news data
1486 func HandleGetMsgs(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1487         if !cc.Authorize(accessNewsReadArt) {
1488                 res = append(res, cc.NewErrReply(t, "You are not allowed to read news."))
1489                 return res, err
1490         }
1491
1492         res = append(res, cc.NewReply(t, NewField(FieldData, cc.Server.FlatNews)))
1493
1494         return res, err
1495 }
1496
1497 func HandleDownloadFile(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1498         if !cc.Authorize(accessDownloadFile) {
1499                 res = append(res, cc.NewErrReply(t, "You are not allowed to download files."))
1500                 return res, err
1501         }
1502
1503         fileName := t.GetField(FieldFileName).Data
1504         filePath := t.GetField(FieldFilePath).Data
1505         resumeData := t.GetField(FieldFileResumeData).Data
1506
1507         var dataOffset int64
1508         var frd FileResumeData
1509         if resumeData != nil {
1510                 if err := frd.UnmarshalBinary(t.GetField(FieldFileResumeData).Data); err != nil {
1511                         return res, err
1512                 }
1513                 // TODO: handle rsrc fork offset
1514                 dataOffset = int64(binary.BigEndian.Uint32(frd.ForkInfoList[0].DataSize[:]))
1515         }
1516
1517         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
1518         if err != nil {
1519                 return res, err
1520         }
1521
1522         hlFile, err := newFileWrapper(cc.Server.FS, fullFilePath, dataOffset)
1523         if err != nil {
1524                 return res, err
1525         }
1526
1527         xferSize := hlFile.ffo.TransferSize(0)
1528
1529         ft := cc.newFileTransfer(FileDownload, fileName, filePath, xferSize)
1530
1531         // TODO: refactor to remove this
1532         if resumeData != nil {
1533                 var frd FileResumeData
1534                 if err := frd.UnmarshalBinary(t.GetField(FieldFileResumeData).Data); err != nil {
1535                         return res, err
1536                 }
1537                 ft.fileResumeData = &frd
1538         }
1539
1540         // Optional field for when a HL v1.5+ client requests file preview
1541         // Used only for TEXT, JPEG, GIFF, BMP or PICT files
1542         // The value will always be 2
1543         if t.GetField(FieldFileTransferOptions).Data != nil {
1544                 ft.options = t.GetField(FieldFileTransferOptions).Data
1545                 xferSize = hlFile.ffo.FlatFileDataForkHeader.DataSize[:]
1546         }
1547
1548         res = append(res, cc.NewReply(t,
1549                 NewField(FieldRefNum, ft.refNum[:]),
1550                 NewField(FieldWaitingCount, []byte{0x00, 0x00}), // TODO: Implement waiting count
1551                 NewField(FieldTransferSize, xferSize),
1552                 NewField(FieldFileSize, hlFile.ffo.FlatFileDataForkHeader.DataSize[:]),
1553         ))
1554
1555         return res, err
1556 }
1557
1558 // Download all files from the specified folder and sub-folders
1559 func HandleDownloadFolder(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1560         if !cc.Authorize(accessDownloadFile) {
1561                 res = append(res, cc.NewErrReply(t, "You are not allowed to download folders."))
1562                 return res, err
1563         }
1564
1565         fullFilePath, err := readPath(cc.Server.Config.FileRoot, t.GetField(FieldFilePath).Data, t.GetField(FieldFileName).Data)
1566         if err != nil {
1567                 return res, err
1568         }
1569
1570         transferSize, err := CalcTotalSize(fullFilePath)
1571         if err != nil {
1572                 return res, err
1573         }
1574         itemCount, err := CalcItemCount(fullFilePath)
1575         if err != nil {
1576                 return res, err
1577         }
1578
1579         fileTransfer := cc.newFileTransfer(FolderDownload, t.GetField(FieldFileName).Data, t.GetField(FieldFilePath).Data, transferSize)
1580
1581         var fp FilePath
1582         _, err = fp.Write(t.GetField(FieldFilePath).Data)
1583         if err != nil {
1584                 return res, err
1585         }
1586
1587         res = append(res, cc.NewReply(t,
1588                 NewField(FieldRefNum, fileTransfer.ReferenceNumber),
1589                 NewField(FieldTransferSize, transferSize),
1590                 NewField(FieldFolderItemCount, itemCount),
1591                 NewField(FieldWaitingCount, []byte{0x00, 0x00}), // TODO: Implement waiting count
1592         ))
1593         return res, err
1594 }
1595
1596 // Upload all files from the local folder and its subfolders to the specified path on the server
1597 // Fields used in the request
1598 // 201  File Name
1599 // 202  File path
1600 // 108  transfer size   Total size of all items in the folder
1601 // 220  Folder item count
1602 // 204  File transfer options   "Optional Currently set to 1" (TODO: ??)
1603 func HandleUploadFolder(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1604         var fp FilePath
1605         if t.GetField(FieldFilePath).Data != nil {
1606                 if _, err = fp.Write(t.GetField(FieldFilePath).Data); err != nil {
1607                         return res, err
1608                 }
1609         }
1610
1611         // Handle special cases for Upload and Drop Box folders
1612         if !cc.Authorize(accessUploadAnywhere) {
1613                 if !fp.IsUploadDir() && !fp.IsDropbox() {
1614                         res = append(res, cc.NewErrReply(t, fmt.Sprintf("Cannot accept upload of the folder \"%v\" because you are only allowed to upload to the \"Uploads\" folder.", string(t.GetField(FieldFileName).Data))))
1615                         return res, err
1616                 }
1617         }
1618
1619         fileTransfer := cc.newFileTransfer(FolderUpload,
1620                 t.GetField(FieldFileName).Data,
1621                 t.GetField(FieldFilePath).Data,
1622                 t.GetField(FieldTransferSize).Data,
1623         )
1624
1625         fileTransfer.FolderItemCount = t.GetField(FieldFolderItemCount).Data
1626
1627         res = append(res, cc.NewReply(t, NewField(FieldRefNum, fileTransfer.ReferenceNumber)))
1628         return res, err
1629 }
1630
1631 // HandleUploadFile
1632 // Fields used in the request:
1633 // 201  File Name
1634 // 202  File path
1635 // 204  File transfer options   "Optional
1636 // Used only to resume download, currently has value 2"
1637 // 108  File transfer size      "Optional used if download is not resumed"
1638 func HandleUploadFile(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1639         if !cc.Authorize(accessUploadFile) {
1640                 res = append(res, cc.NewErrReply(t, "You are not allowed to upload files."))
1641                 return res, err
1642         }
1643
1644         fileName := t.GetField(FieldFileName).Data
1645         filePath := t.GetField(FieldFilePath).Data
1646         transferOptions := t.GetField(FieldFileTransferOptions).Data
1647         transferSize := t.GetField(FieldTransferSize).Data // not sent for resume
1648
1649         var fp FilePath
1650         if filePath != nil {
1651                 if _, err = fp.Write(filePath); err != nil {
1652                         return res, err
1653                 }
1654         }
1655
1656         // Handle special cases for Upload and Drop Box folders
1657         if !cc.Authorize(accessUploadAnywhere) {
1658                 if !fp.IsUploadDir() && !fp.IsDropbox() {
1659                         res = append(res, cc.NewErrReply(t, fmt.Sprintf("Cannot accept upload of the file \"%v\" because you are only allowed to upload to the \"Uploads\" folder.", string(fileName))))
1660                         return res, err
1661                 }
1662         }
1663         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
1664         if err != nil {
1665                 return res, err
1666         }
1667
1668         if _, err := cc.Server.FS.Stat(fullFilePath); err == nil {
1669                 res = append(res, cc.NewErrReply(t, fmt.Sprintf("Cannot accept upload because there is already a file named \"%v\".  Try choosing a different Name.", string(fileName))))
1670                 return res, err
1671         }
1672
1673         ft := cc.newFileTransfer(FileUpload, fileName, filePath, transferSize)
1674
1675         replyT := cc.NewReply(t, NewField(FieldRefNum, ft.ReferenceNumber))
1676
1677         // client has requested to resume a partially transferred file
1678         if transferOptions != nil {
1679                 fileInfo, err := cc.Server.FS.Stat(fullFilePath + incompleteFileSuffix)
1680                 if err != nil {
1681                         return res, err
1682                 }
1683
1684                 offset := make([]byte, 4)
1685                 binary.BigEndian.PutUint32(offset, uint32(fileInfo.Size()))
1686
1687                 fileResumeData := NewFileResumeData([]ForkInfoList{
1688                         *NewForkInfoList(offset),
1689                 })
1690
1691                 b, _ := fileResumeData.BinaryMarshal()
1692
1693                 ft.TransferSize = offset
1694
1695                 replyT.Fields = append(replyT.Fields, NewField(FieldFileResumeData, b))
1696         }
1697
1698         res = append(res, replyT)
1699         return res, err
1700 }
1701
1702 func HandleSetClientUserInfo(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1703         if len(t.GetField(FieldUserIconID).Data) == 4 {
1704                 cc.Icon = t.GetField(FieldUserIconID).Data[2:]
1705         } else {
1706                 cc.Icon = t.GetField(FieldUserIconID).Data
1707         }
1708         if cc.Authorize(accessAnyName) {
1709                 cc.UserName = t.GetField(FieldUserName).Data
1710         }
1711
1712         // the options field is only passed by the client versions > 1.2.3.
1713         options := t.GetField(FieldOptions).Data
1714         if options != nil {
1715                 optBitmap := big.NewInt(int64(binary.BigEndian.Uint16(options)))
1716                 flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(cc.Flags)))
1717
1718                 flagBitmap.SetBit(flagBitmap, UserFlagRefusePM, optBitmap.Bit(UserOptRefusePM))
1719                 binary.BigEndian.PutUint16(cc.Flags, uint16(flagBitmap.Int64()))
1720
1721                 flagBitmap.SetBit(flagBitmap, UserFlagRefusePChat, optBitmap.Bit(UserOptRefuseChat))
1722                 binary.BigEndian.PutUint16(cc.Flags, uint16(flagBitmap.Int64()))
1723
1724                 // Check auto response
1725                 if optBitmap.Bit(UserOptAutoResponse) == 1 {
1726                         cc.AutoReply = t.GetField(FieldAutomaticResponse).Data
1727                 } else {
1728                         cc.AutoReply = []byte{}
1729                 }
1730         }
1731
1732         for _, c := range sortedClients(cc.Server.Clients) {
1733                 res = append(res, *NewTransaction(
1734                         TranNotifyChangeUser,
1735                         c.ID,
1736                         NewField(FieldUserID, *cc.ID),
1737                         NewField(FieldUserIconID, cc.Icon),
1738                         NewField(FieldUserFlags, cc.Flags),
1739                         NewField(FieldUserName, cc.UserName),
1740                 ))
1741         }
1742
1743         return res, err
1744 }
1745
1746 // HandleKeepAlive responds to keepalive transactions with an empty reply
1747 // * HL 1.9.2 Client sends keepalive msg every 3 minutes
1748 // * HL 1.2.3 Client doesn't send keepalives
1749 func HandleKeepAlive(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1750         res = append(res, cc.NewReply(t))
1751
1752         return res, err
1753 }
1754
1755 func HandleGetFileNameList(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1756         fullPath, err := readPath(
1757                 cc.Server.Config.FileRoot,
1758                 t.GetField(FieldFilePath).Data,
1759                 nil,
1760         )
1761         if err != nil {
1762                 return res, err
1763         }
1764
1765         var fp FilePath
1766         if t.GetField(FieldFilePath).Data != nil {
1767                 if _, err = fp.Write(t.GetField(FieldFilePath).Data); err != nil {
1768                         return res, err
1769                 }
1770         }
1771
1772         // Handle special case for drop box folders
1773         if fp.IsDropbox() && !cc.Authorize(accessViewDropBoxes) {
1774                 res = append(res, cc.NewErrReply(t, "You are not allowed to view drop boxes."))
1775                 return res, err
1776         }
1777
1778         fileNames, err := getFileNameList(fullPath, cc.Server.Config.IgnoreFiles)
1779         if err != nil {
1780                 return res, err
1781         }
1782
1783         res = append(res, cc.NewReply(t, fileNames...))
1784
1785         return res, err
1786 }
1787
1788 // =================================
1789 //     Hotline private chat flow
1790 // =================================
1791 // 1. ClientA sends TranInviteNewChat to server with user ID to invite
1792 // 2. Server creates new ChatID
1793 // 3. Server sends TranInviteToChat to invitee
1794 // 4. Server replies to ClientA with new Chat ID
1795 //
1796 // A dialog box pops up in the invitee client with options to accept or decline the invitation.
1797 // If Accepted is clicked:
1798 // 1. ClientB sends TranJoinChat with FieldChatID
1799
1800 // HandleInviteNewChat invites users to new private chat
1801 func HandleInviteNewChat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1802         if !cc.Authorize(accessOpenChat) {
1803                 res = append(res, cc.NewErrReply(t, "You are not allowed to request private chat."))
1804                 return res, err
1805         }
1806
1807         // Client to Invite
1808         targetID := t.GetField(FieldUserID).Data
1809         newChatID := cc.Server.NewPrivateChat(cc)
1810
1811         // Check if target user has "Refuse private chat" flag
1812         binary.BigEndian.Uint16(targetID)
1813         targetClient := cc.Server.Clients[binary.BigEndian.Uint16(targetID)]
1814
1815         flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(targetClient.Flags)))
1816         if flagBitmap.Bit(UserFlagRefusePChat) == 1 {
1817                 res = append(res,
1818                         *NewTransaction(
1819                                 TranServerMsg,
1820                                 cc.ID,
1821                                 NewField(FieldData, []byte(string(targetClient.UserName)+" does not accept private chats.")),
1822                                 NewField(FieldUserName, targetClient.UserName),
1823                                 NewField(FieldUserID, *targetClient.ID),
1824                                 NewField(FieldOptions, []byte{0, 2}),
1825                         ),
1826                 )
1827         } else {
1828                 res = append(res,
1829                         *NewTransaction(
1830                                 TranInviteToChat,
1831                                 &targetID,
1832                                 NewField(FieldChatID, newChatID),
1833                                 NewField(FieldUserName, cc.UserName),
1834                                 NewField(FieldUserID, *cc.ID),
1835                         ),
1836                 )
1837         }
1838
1839         res = append(res,
1840                 cc.NewReply(t,
1841                         NewField(FieldChatID, newChatID),
1842                         NewField(FieldUserName, cc.UserName),
1843                         NewField(FieldUserID, *cc.ID),
1844                         NewField(FieldUserIconID, cc.Icon),
1845                         NewField(FieldUserFlags, cc.Flags),
1846                 ),
1847         )
1848
1849         return res, err
1850 }
1851
1852 func HandleInviteToChat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1853         if !cc.Authorize(accessOpenChat) {
1854                 res = append(res, cc.NewErrReply(t, "You are not allowed to request private chat."))
1855                 return res, err
1856         }
1857
1858         // Client to Invite
1859         targetID := t.GetField(FieldUserID).Data
1860         chatID := t.GetField(FieldChatID).Data
1861
1862         res = append(res,
1863                 *NewTransaction(
1864                         TranInviteToChat,
1865                         &targetID,
1866                         NewField(FieldChatID, chatID),
1867                         NewField(FieldUserName, cc.UserName),
1868                         NewField(FieldUserID, *cc.ID),
1869                 ),
1870         )
1871         res = append(res,
1872                 cc.NewReply(
1873                         t,
1874                         NewField(FieldChatID, chatID),
1875                         NewField(FieldUserName, cc.UserName),
1876                         NewField(FieldUserID, *cc.ID),
1877                         NewField(FieldUserIconID, cc.Icon),
1878                         NewField(FieldUserFlags, cc.Flags),
1879                 ),
1880         )
1881
1882         return res, err
1883 }
1884
1885 func HandleRejectChatInvite(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1886         chatID := t.GetField(FieldChatID).Data
1887         chatInt := binary.BigEndian.Uint32(chatID)
1888
1889         privChat := cc.Server.PrivateChats[chatInt]
1890
1891         resMsg := append(cc.UserName, []byte(" declined invitation to chat")...)
1892
1893         for _, c := range sortedClients(privChat.ClientConn) {
1894                 res = append(res,
1895                         *NewTransaction(
1896                                 TranChatMsg,
1897                                 c.ID,
1898                                 NewField(FieldChatID, chatID),
1899                                 NewField(FieldData, resMsg),
1900                         ),
1901                 )
1902         }
1903
1904         return res, err
1905 }
1906
1907 // HandleJoinChat is sent from a v1.8+ Hotline client when the joins a private chat
1908 // Fields used in the reply:
1909 // * 115        Chat subject
1910 // * 300        User Name with info (Optional)
1911 // * 300        (more user names with info)
1912 func HandleJoinChat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1913         chatID := t.GetField(FieldChatID).Data
1914         chatInt := binary.BigEndian.Uint32(chatID)
1915
1916         privChat := cc.Server.PrivateChats[chatInt]
1917
1918         // Send TranNotifyChatChangeUser to current members of the chat to inform of new user
1919         for _, c := range sortedClients(privChat.ClientConn) {
1920                 res = append(res,
1921                         *NewTransaction(
1922                                 TranNotifyChatChangeUser,
1923                                 c.ID,
1924                                 NewField(FieldChatID, chatID),
1925                                 NewField(FieldUserName, cc.UserName),
1926                                 NewField(FieldUserID, *cc.ID),
1927                                 NewField(FieldUserIconID, cc.Icon),
1928                                 NewField(FieldUserFlags, cc.Flags),
1929                         ),
1930                 )
1931         }
1932
1933         privChat.ClientConn[cc.uint16ID()] = cc
1934
1935         replyFields := []Field{NewField(FieldChatSubject, []byte(privChat.Subject))}
1936         for _, c := range sortedClients(privChat.ClientConn) {
1937
1938                 b, err := io.ReadAll(&User{
1939                         ID:    *c.ID,
1940                         Icon:  c.Icon,
1941                         Flags: c.Flags,
1942                         Name:  string(c.UserName),
1943                 })
1944                 if err != nil {
1945                         return res, nil
1946                 }
1947                 replyFields = append(replyFields, NewField(FieldUsernameWithInfo, b))
1948         }
1949
1950         res = append(res, cc.NewReply(t, replyFields...))
1951         return res, err
1952 }
1953
1954 // HandleLeaveChat is sent from a v1.8+ Hotline client when the user exits a private chat
1955 // Fields used in the request:
1956 //   - 114      FieldChatID
1957 //
1958 // Reply is not expected.
1959 func HandleLeaveChat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1960         chatID := t.GetField(FieldChatID).Data
1961         chatInt := binary.BigEndian.Uint32(chatID)
1962
1963         privChat, ok := cc.Server.PrivateChats[chatInt]
1964         if !ok {
1965                 return res, nil
1966         }
1967
1968         delete(privChat.ClientConn, cc.uint16ID())
1969
1970         // Notify members of the private chat that the user has left
1971         for _, c := range sortedClients(privChat.ClientConn) {
1972                 res = append(res,
1973                         *NewTransaction(
1974                                 TranNotifyChatDeleteUser,
1975                                 c.ID,
1976                                 NewField(FieldChatID, chatID),
1977                                 NewField(FieldUserID, *cc.ID),
1978                         ),
1979                 )
1980         }
1981
1982         return res, err
1983 }
1984
1985 // HandleSetChatSubject is sent from a v1.8+ Hotline client when the user sets a private chat subject
1986 // Fields used in the request:
1987 // * 114        Chat ID
1988 // * 115        Chat subject
1989 // Reply is not expected.
1990 func HandleSetChatSubject(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
1991         chatID := t.GetField(FieldChatID).Data
1992         chatInt := binary.BigEndian.Uint32(chatID)
1993
1994         privChat := cc.Server.PrivateChats[chatInt]
1995         privChat.Subject = string(t.GetField(FieldChatSubject).Data)
1996
1997         for _, c := range sortedClients(privChat.ClientConn) {
1998                 res = append(res,
1999                         *NewTransaction(
2000                                 TranNotifyChatSubject,
2001                                 c.ID,
2002                                 NewField(FieldChatID, chatID),
2003                                 NewField(FieldChatSubject, t.GetField(FieldChatSubject).Data),
2004                         ),
2005                 )
2006         }
2007
2008         return res, err
2009 }
2010
2011 // HandleMakeAlias makes a file alias using the specified path.
2012 // Fields used in the request:
2013 // 201  File Name
2014 // 202  File path
2015 // 212  File new path   Destination path
2016 //
2017 // Fields used in the reply:
2018 // None
2019 func HandleMakeAlias(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
2020         if !cc.Authorize(accessMakeAlias) {
2021                 res = append(res, cc.NewErrReply(t, "You are not allowed to make aliases."))
2022                 return res, err
2023         }
2024         fileName := t.GetField(FieldFileName).Data
2025         filePath := t.GetField(FieldFilePath).Data
2026         fileNewPath := t.GetField(FieldFileNewPath).Data
2027
2028         fullFilePath, err := readPath(cc.Server.Config.FileRoot, filePath, fileName)
2029         if err != nil {
2030                 return res, err
2031         }
2032
2033         fullNewFilePath, err := readPath(cc.Server.Config.FileRoot, fileNewPath, fileName)
2034         if err != nil {
2035                 return res, err
2036         }
2037
2038         cc.logger.Debug("Make alias", "src", fullFilePath, "dst", fullNewFilePath)
2039
2040         if err := cc.Server.FS.Symlink(fullFilePath, fullNewFilePath); err != nil {
2041                 res = append(res, cc.NewErrReply(t, "Error creating alias"))
2042                 return res, nil
2043         }
2044
2045         res = append(res, cc.NewReply(t))
2046         return res, err
2047 }
2048
2049 // HandleDownloadBanner handles requests for a new banner from the server
2050 // Fields used in the request:
2051 // None
2052 // Fields used in the reply:
2053 // 107  FieldRefNum                     Used later for transfer
2054 // 108  FieldTransferSize       Size of data to be downloaded
2055 func HandleDownloadBanner(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
2056         fi, err := cc.Server.FS.Stat(filepath.Join(cc.Server.ConfigDir, cc.Server.Config.BannerFile))
2057         if err != nil {
2058                 return res, err
2059         }
2060
2061         ft := cc.newFileTransfer(bannerDownload, []byte{}, []byte{}, make([]byte, 4))
2062
2063         binary.BigEndian.PutUint32(ft.TransferSize, uint32(fi.Size()))
2064
2065         res = append(res, cc.NewReply(t,
2066                 NewField(FieldRefNum, ft.refNum[:]),
2067                 NewField(FieldTransferSize, ft.TransferSize),
2068         ))
2069
2070         return res, err
2071 }