Prevent account from creating new account with greater permission

[rbdr/mobius] / hotline / access.go

diff --git a/hotline/access.go b/hotline/access.go
index ae72780871c61213d3976fbf1695aff6b9ed0911..e2e728caf9c7a136ac2f8b97f06ad12f77cefe69 100644 (file)
--- a/hotline/access.go
+++ b/hotline/access.go
@@ -1,10 +1,5 @@
 package hotline
 
-import (
-       "encoding/binary"
-       "math/big"
-)
-
 const (
        accessDeleteFile       = 0  // File System Maintenance: Can Delete Files
        accessUploadFile       = 1  // File System Maintenance: Can Upload Files
@@ -25,7 +20,6 @@ const (
        accessOpenUser         = 16 // User Maintenance: Can Read Accounts
        accessModifyUser       = 17 // User Maintenance: Can Modify Accounts
        accessChangeOwnPass    = 18 // Present in the Hotline 1.9 protocol documentation, but seemingly unused
-       accessSendPrivMsg      = 19 // Messaging: Can Send Messages
        accessNewsReadArt      = 20 // News: Can Read Articles
        accessNewsPostArt      = 21 // News: Can Post Articles
        accessDisconUser       = 22 // User Maintenance: Can Disconnect Users (Note: Turns username red in user list)
@@ -44,6 +38,7 @@ const (
        accessNewsDeleteCat    = 35 // News: Can Delete Categories
        accessNewsCreateFldr   = 36 // News: Can Create News Bundles
        accessNewsDeleteFldr   = 37 // News: Can Delete News Bundles
+       accessSendPrivMsg      = 40 // Messaging: Can Send Messages (Note: 1.9 protocol doc incorrectly says this is bit 19)
 )
 
 type accessBitmap [8]byte
@@ -52,10 +47,6 @@ func (bits *accessBitmap) Set(i int) {
        bits[i/8] |= 1 << uint(7-i%8)
 }
 
-// authorize checks if 64 bit access slice contain has accessBit set
-// TODO: refactor to use accessBitmap type
-func authorize(access *[]byte, accessBit int) bool {
-       bits := big.NewInt(int64(binary.BigEndian.Uint64(*access)))
-
-       return bits.Bit(63-accessBit) == 1
+func (bits *accessBitmap) IsSet(i int) bool {
+       return bits[i/8]&(1<<uint(7-i%8)) != 0
 }