X-Git-Url: https://git.r.bdr.sh/rbdr/mobius/blobdiff_plain/1632959187e9c7d8946126914af99270fc14d40a..501973cdaaccc9f10c1427cab7edaddf7f89fcdb:/hotline/transaction_handlers.go?ds=sidebyside

diff --git a/hotline/transaction_handlers.go b/hotline/transaction_handlers.go
index 85879a4..6816456 100644
--- a/hotline/transaction_handlers.go
+++ b/hotline/transaction_handlers.go
@@ -6,7 +6,6 @@ import (
 	"errors"
 	"fmt"
 	"gopkg.in/yaml.v3"
-	"io/ioutil"
 	"math/big"
 	"os"
 	"path"
@@ -238,7 +237,7 @@ var TransactionHandlers = map[uint16]TransactionType{
 }
 
 func HandleChatSend(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessSendChat) {
+	if !cc.Authorize(accessSendChat) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to participate in chat."))
 		return res, err
 	}
@@ -254,9 +253,10 @@ func HandleChatSend(cc *ClientConn, t *Transaction) (res []Transaction, err erro
 		formattedMsg = fmt.Sprintf("\r*** %s %s", cc.UserName, t.GetField(fieldData).Data)
 	}
 
+	// The ChatID field is used to identify messages as belonging to a private chat.
+	// All clients *except* Frogblast omit this field for public chat, but Frogblast sends a value of 00 00 00 00.
 	chatID := t.GetField(fieldChatID).Data
-	// a non-nil chatID indicates the message belongs to a private chat
-	if chatID != nil {
+	if chatID != nil && !bytes.Equal([]byte{0, 0, 0, 0}, chatID) {
 		chatInt := binary.BigEndian.Uint32(chatID)
 		privChat := cc.Server.PrivateChats[chatInt]
 
@@ -276,7 +276,7 @@ func HandleChatSend(cc *ClientConn, t *Transaction) (res []Transaction, err erro
 
 	for _, c := range sortedClients(cc.Server.Clients) {
 		// Filter out clients that do not have the read chat permission
-		if authorize(c.Account.Access, accessReadChat) {
+		if c.Authorize(accessReadChat) {
 			res = append(res, *NewTransaction(tranChatMsg, c.ID, NewField(fieldData, []byte(formattedMsg))))
 		}
 	}
@@ -322,14 +322,29 @@ func HandleSendInstantMsg(cc *ClientConn, t *Transaction) (res []Transaction, er
 		reply.Fields = append(reply.Fields, NewField(fieldQuotingMsg, t.GetField(fieldQuotingMsg).Data))
 	}
 
-	res = append(res, *reply)
-
 	id, _ := byteToInt(ID.Data)
 	otherClient, ok := cc.Server.Clients[uint16(id)]
 	if !ok {
 		return res, errors.New("invalid client ID")
 	}
 
+	// Check if target user has "Refuse private messages" flag
+	flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(otherClient.Flags)))
+	if flagBitmap.Bit(userFLagRefusePChat) == 1 {
+		res = append(res,
+			*NewTransaction(
+				tranServerMsg,
+				cc.ID,
+				NewField(fieldData, []byte(string(otherClient.UserName)+" does not accept private messages.")),
+				NewField(fieldUserName, otherClient.UserName),
+				NewField(fieldUserID, *otherClient.ID),
+				NewField(fieldOptions, []byte{0, 2}),
+			),
+		)
+	} else {
+		res = append(res, *reply)
+	}
+
 	// Respond with auto reply if other client has it enabled
 	if len(otherClient.AutoReply) > 0 {
 		res = append(res,
@@ -404,12 +419,12 @@ func HandleSetFileInfo(cc *ClientConn, t *Transaction) (res []Transaction, err e
 	if t.GetField(fieldFileComment).Data != nil {
 		switch mode := fi.Mode(); {
 		case mode.IsDir():
-			if !authorize(cc.Account.Access, accessSetFolderComment) {
+			if !cc.Authorize(accessSetFolderComment) {
 				res = append(res, cc.NewErrReply(t, "You are not allowed to set comments for folders."))
 				return res, err
 			}
 		case mode.IsRegular():
-			if !authorize(cc.Account.Access, accessSetFileComment) {
+			if !cc.Authorize(accessSetFileComment) {
 				res = append(res, cc.NewErrReply(t, "You are not allowed to set comments for files."))
 				return res, err
 			}
@@ -438,7 +453,7 @@ func HandleSetFileInfo(cc *ClientConn, t *Transaction) (res []Transaction, err e
 	if fileNewName != nil {
 		switch mode := fi.Mode(); {
 		case mode.IsDir():
-			if !authorize(cc.Account.Access, accessRenameFolder) {
+			if !cc.Authorize(accessRenameFolder) {
 				res = append(res, cc.NewErrReply(t, "You are not allowed to rename folders."))
 				return res, err
 			}
@@ -448,7 +463,7 @@ func HandleSetFileInfo(cc *ClientConn, t *Transaction) (res []Transaction, err e
 				return res, err
 			}
 		case mode.IsRegular():
-			if !authorize(cc.Account.Access, accessRenameFile) {
+			if !cc.Authorize(accessRenameFile) {
 				res = append(res, cc.NewErrReply(t, "You are not allowed to rename files."))
 				return res, err
 			}
@@ -463,7 +478,7 @@ func HandleSetFileInfo(cc *ClientConn, t *Transaction) (res []Transaction, err e
 				return res, err
 			}
 			if err != nil {
-				panic(err)
+				return res, err
 			}
 		}
 	}
@@ -499,12 +514,12 @@ func HandleDeleteFile(cc *ClientConn, t *Transaction) (res []Transaction, err er
 
 	switch mode := fi.Mode(); {
 	case mode.IsDir():
-		if !authorize(cc.Account.Access, accessDeleteFolder) {
+		if !cc.Authorize(accessDeleteFolder) {
 			res = append(res, cc.NewErrReply(t, "You are not allowed to delete folders."))
 			return res, err
 		}
 	case mode.IsRegular():
-		if !authorize(cc.Account.Access, accessDeleteFile) {
+		if !cc.Authorize(accessDeleteFile) {
 			res = append(res, cc.NewErrReply(t, "You are not allowed to delete files."))
 			return res, err
 		}
@@ -549,12 +564,12 @@ func HandleMoveFile(cc *ClientConn, t *Transaction) (res []Transaction, err erro
 	}
 	switch mode := fi.Mode(); {
 	case mode.IsDir():
-		if !authorize(cc.Account.Access, accessMoveFolder) {
+		if !cc.Authorize(accessMoveFolder) {
 			res = append(res, cc.NewErrReply(t, "You are not allowed to move folders."))
 			return res, err
 		}
 	case mode.IsRegular():
-		if !authorize(cc.Account.Access, accessMoveFile) {
+		if !cc.Authorize(accessMoveFile) {
 			res = append(res, cc.NewErrReply(t, "You are not allowed to move files."))
 			return res, err
 		}
@@ -569,7 +584,7 @@ func HandleMoveFile(cc *ClientConn, t *Transaction) (res []Transaction, err erro
 }
 
 func HandleNewFolder(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessCreateFolder) {
+	if !cc.Authorize(accessCreateFolder) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to create folders."))
 		return res, err
 	}
@@ -582,7 +597,7 @@ func HandleNewFolder(cc *ClientConn, t *Transaction) (res []Transaction, err err
 	// fieldFilePath is only present for nested paths
 	if t.GetField(fieldFilePath).Data != nil {
 		var newFp FilePath
-		err := newFp.UnmarshalBinary(t.GetField(fieldFilePath).Data)
+		_, err := newFp.Write(t.GetField(fieldFilePath).Data)
 		if err != nil {
 			return nil, err
 		}
@@ -612,7 +627,7 @@ func HandleNewFolder(cc *ClientConn, t *Transaction) (res []Transaction, err err
 }
 
 func HandleSetUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessModifyUser) {
+	if !cc.Authorize(accessModifyUser) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to modify accounts."))
 		return res, err
 	}
@@ -623,8 +638,8 @@ func HandleSetUser(cc *ClientConn, t *Transaction) (res []Transaction, err error
 	newAccessLvl := t.GetField(fieldUserAccess).Data
 
 	account := cc.Server.Accounts[login]
-	account.Access = &newAccessLvl
 	account.Name = userName
+	copy(account.Access[:], newAccessLvl)
 
 	// If the password field is cleared in the Hotline edit user UI, the SetUser transaction does
 	// not include fieldUserPassword
@@ -651,7 +666,7 @@ func HandleSetUser(cc *ClientConn, t *Transaction) (res []Transaction, err error
 			res = append(res, *newT)
 
 			flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(c.Flags)))
-			if authorize(c.Account.Access, accessDisconUser) {
+			if c.Authorize(accessDisconUser) {
 				flagBitmap.SetBit(flagBitmap, userFlagAdmin, 1)
 			} else {
 				flagBitmap.SetBit(flagBitmap, userFlagAdmin, 0)
@@ -675,7 +690,7 @@ func HandleSetUser(cc *ClientConn, t *Transaction) (res []Transaction, err error
 }
 
 func HandleGetUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessOpenUser) {
+	if !cc.Authorize(accessOpenUser) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to view accounts."))
 		return res, err
 	}
@@ -690,13 +705,13 @@ func HandleGetUser(cc *ClientConn, t *Transaction) (res []Transaction, err error
 		NewField(fieldUserName, []byte(account.Name)),
 		NewField(fieldUserLogin, negateString(t.GetField(fieldUserLogin).Data)),
 		NewField(fieldUserPassword, []byte(account.Password)),
-		NewField(fieldUserAccess, *account.Access),
+		NewField(fieldUserAccess, account.Access[:]),
 	))
 	return res, err
 }
 
 func HandleListUsers(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessOpenUser) {
+	if !cc.Authorize(accessOpenUser) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to view accounts."))
 		return res, err
 	}
@@ -736,7 +751,7 @@ func HandleUpdateUser(cc *ClientConn, t *Transaction) (res []Transaction, err er
 			login := DecodeUserString(getField(fieldData, &subFields).Data)
 			cc.logger.Infow("DeleteUser", "login", login)
 
-			if !authorize(cc.Account.Access, accessDeleteUser) {
+			if !cc.Authorize(accessDeleteUser) {
 				res = append(res, cc.NewErrReply(t, "You are not allowed to delete accounts."))
 				return res, err
 			}
@@ -754,7 +769,7 @@ func HandleUpdateUser(cc *ClientConn, t *Transaction) (res []Transaction, err er
 			cc.logger.Infow("UpdateUser", "login", login)
 
 			// account dataFile, so this is an update action
-			if !authorize(cc.Account.Access, accessModifyUser) {
+			if !cc.Authorize(accessModifyUser) {
 				res = append(res, cc.NewErrReply(t, "You are not allowed to modify accounts."))
 				return res, err
 			}
@@ -767,7 +782,7 @@ func HandleUpdateUser(cc *ClientConn, t *Transaction) (res []Transaction, err er
 			}
 
 			if getField(fieldUserAccess, &subFields) != nil {
-				acc.Access = &getField(fieldUserAccess, &subFields).Data
+				copy(acc.Access[:], getField(fieldUserAccess, &subFields).Data)
 			}
 
 			err = cc.Server.UpdateUser(
@@ -775,7 +790,7 @@ func HandleUpdateUser(cc *ClientConn, t *Transaction) (res []Transaction, err er
 				DecodeUserString(getField(fieldUserLogin, &subFields).Data),
 				string(getField(fieldUserName, &subFields).Data),
 				acc.Password,
-				*acc.Access,
+				acc.Access,
 			)
 			if err != nil {
 				return res, err
@@ -783,17 +798,24 @@ func HandleUpdateUser(cc *ClientConn, t *Transaction) (res []Transaction, err er
 		} else {
 			cc.logger.Infow("CreateUser", "login", login)
 
-			if !authorize(cc.Account.Access, accessCreateUser) {
+			if !cc.Authorize(accessCreateUser) {
 				res = append(res, cc.NewErrReply(t, "You are not allowed to create new accounts."))
 				return res, err
 			}
 
-			err := cc.Server.NewUser(
-				login,
-				string(getField(fieldUserName, &subFields).Data),
-				string(getField(fieldUserPassword, &subFields).Data),
-				getField(fieldUserAccess, &subFields).Data,
-			)
+			newAccess := accessBitmap{}
+			copy(newAccess[:], getField(fieldUserAccess, &subFields).Data[:])
+
+			// Prevent account from creating new account with greater permission
+			for i := 0; i < 64; i++ {
+				if newAccess.IsSet(i) {
+					if !cc.Authorize(i) {
+						return append(res, cc.NewErrReply(t, "Cannot create account with more access than yourself.")), err
+					}
+				}
+			}
+
+			err := cc.Server.NewUser(login, string(getField(fieldUserName, &subFields).Data), string(getField(fieldUserPassword, &subFields).Data), newAccess)
 			if err != nil {
 				return []Transaction{}, err
 			}
@@ -806,7 +828,7 @@ func HandleUpdateUser(cc *ClientConn, t *Transaction) (res []Transaction, err er
 
 // HandleNewUser creates a new user account
 func HandleNewUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessCreateUser) {
+	if !cc.Authorize(accessCreateUser) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to create new accounts."))
 		return res, err
 	}
@@ -819,12 +841,20 @@ func HandleNewUser(cc *ClientConn, t *Transaction) (res []Transaction, err error
 		return res, err
 	}
 
-	if err := cc.Server.NewUser(
-		login,
-		string(t.GetField(fieldUserName).Data),
-		string(t.GetField(fieldUserPassword).Data),
-		t.GetField(fieldUserAccess).Data,
-	); err != nil {
+	newAccess := accessBitmap{}
+	copy(newAccess[:], t.GetField(fieldUserAccess).Data[:])
+
+	// Prevent account from creating new account with greater permission
+	for i := 0; i < 64; i++ {
+		if newAccess.IsSet(i) {
+			if !cc.Authorize(i) {
+				res = append(res, cc.NewErrReply(t, "Cannot create account with more access than yourself."))
+				return res, err
+			}
+		}
+	}
+
+	if err := cc.Server.NewUser(login, string(t.GetField(fieldUserName).Data), string(t.GetField(fieldUserPassword).Data), newAccess); err != nil {
 		return []Transaction{}, err
 	}
 
@@ -833,7 +863,7 @@ func HandleNewUser(cc *ClientConn, t *Transaction) (res []Transaction, err error
 }
 
 func HandleDeleteUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessDeleteUser) {
+	if !cc.Authorize(accessDeleteUser) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to delete accounts."))
 		return res, err
 	}
@@ -851,7 +881,7 @@ func HandleDeleteUser(cc *ClientConn, t *Transaction) (res []Transaction, err er
 
 // HandleUserBroadcast sends an Administrator Message to all connected clients of the server
 func HandleUserBroadcast(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessBroadcast) {
+	if !cc.Authorize(accessBroadcast) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to send broadcast messages."))
 		return res, err
 	}
@@ -886,7 +916,7 @@ func byteToInt(bytes []byte) (int, error) {
 // 102	User name
 // 101	Data		User info text string
 func HandleGetClientInfoText(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessGetClientInfo) {
+	if !cc.Authorize(accessGetClientInfo) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to get client info."))
 		return res, err
 	}
@@ -925,7 +955,7 @@ func HandleTranAgreed(cc *ClientConn, t *Transaction) (res []Transaction, err er
 	cc.Icon = t.GetField(fieldUserIconID).Data
 
 	cc.logger = cc.logger.With("name", string(cc.UserName))
-	cc.logger.Infow("Login successful", "clientVersion", fmt.Sprintf("%x", cc.Version))
+	cc.logger.Infow("Login successful", "clientVersion", fmt.Sprintf("%v", func() int { i, _ := byteToInt(cc.Version); return i }()))
 
 	options := t.GetField(fieldOptions).Data
 	optBitmap := big.NewInt(int64(binary.BigEndian.Uint16(options)))
@@ -984,7 +1014,7 @@ __________________________________________________________`
 // Fields used in this request:
 // 101	Data
 func HandleTranOldPostNews(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessNewsPostArt) {
+	if !cc.Authorize(accessNewsPostArt) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to post news."))
 		return res, err
 	}
@@ -1009,7 +1039,7 @@ func HandleTranOldPostNews(cc *ClientConn, t *Transaction) (res []Transaction, e
 	cc.Server.FlatNews = append([]byte(newsPost), cc.Server.FlatNews...)
 
 	// update news on disk
-	if err := ioutil.WriteFile(cc.Server.ConfigDir+"MessageBoard.txt", cc.Server.FlatNews, 0644); err != nil {
+	if err := cc.Server.FS.WriteFile(filepath.Join(cc.Server.ConfigDir, "MessageBoard.txt"), cc.Server.FlatNews, 0644); err != nil {
 		return res, err
 	}
 
@@ -1024,14 +1054,14 @@ func HandleTranOldPostNews(cc *ClientConn, t *Transaction) (res []Transaction, e
 }
 
 func HandleDisconnectUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessDisconUser) {
+	if !cc.Authorize(accessDisconUser) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to disconnect users."))
 		return res, err
 	}
 
 	clientConn := cc.Server.Clients[binary.BigEndian.Uint16(t.GetField(fieldUserID).Data)]
 
-	if authorize(clientConn.Account.Access, accessCannotBeDiscon) {
+	if clientConn.Authorize(accessCannotBeDiscon) {
 		res = append(res, cc.NewErrReply(t, clientConn.Account.Login+" is not allowed to be disconnected."))
 		return res, err
 	}
@@ -1084,7 +1114,7 @@ func HandleDisconnectUser(cc *ClientConn, t *Transaction) (res []Transaction, er
 // Fields used in the request:
 // 325	News path	(Optional)
 func HandleGetNewsCatNameList(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessNewsReadArt) {
+	if !cc.Authorize(accessNewsReadArt) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to read news."))
 		return res, err
 	}
@@ -1116,7 +1146,7 @@ func HandleGetNewsCatNameList(cc *ClientConn, t *Transaction) (res []Transaction
 }
 
 func HandleNewNewsCat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessNewsCreateCat) {
+	if !cc.Authorize(accessNewsCreateCat) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to create news categories."))
 		return res, err
 	}
@@ -1143,7 +1173,7 @@ func HandleNewNewsCat(cc *ClientConn, t *Transaction) (res []Transaction, err er
 // 322	News category name
 // 325	News path
 func HandleNewNewsFldr(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessNewsCreateFldr) {
+	if !cc.Authorize(accessNewsCreateFldr) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to create news folders."))
 		return res, err
 	}
@@ -1173,7 +1203,7 @@ func HandleNewNewsFldr(cc *ClientConn, t *Transaction) (res []Transaction, err e
 // Reply fields:
 // 321	News article list data	Optional
 func HandleGetNewsArtNameList(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessNewsReadArt) {
+	if !cc.Authorize(accessNewsReadArt) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to read news."))
 		return res, err
 	}
@@ -1194,7 +1224,7 @@ func HandleGetNewsArtNameList(cc *ClientConn, t *Transaction) (res []Transaction
 }
 
 func HandleGetNewsArtData(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessNewsReadArt) {
+	if !cc.Authorize(accessNewsReadArt) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to read news."))
 		return res, err
 	}
@@ -1248,18 +1278,15 @@ func HandleGetNewsArtData(cc *ClientConn, t *Transaction) (res []Transaction, er
 	return res, err
 }
 
+// HandleDelNewsItem deletes an existing threaded news folder or category from the server.
+// Fields used in the request:
+// 325	News path
+// Fields used in the reply:
+// None
 func HandleDelNewsItem(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	// Has multiple access flags: News Delete Folder (37) or News Delete Category (35)
-	// TODO: Implement
-
 	pathStrs := ReadNewsPath(t.GetField(fieldNewsPath).Data)
 
-	// TODO: determine if path is a Folder (Bundle) or Category and check for permission
-
-	cc.logger.Infof("DelNewsItem %v", pathStrs)
-
 	cats := cc.Server.ThreadedNews.Categories
-
 	delName := pathStrs[len(pathStrs)-1]
 	if len(pathStrs) > 1 {
 		for _, fp := range pathStrs[0 : len(pathStrs)-1] {
@@ -1267,21 +1294,27 @@ func HandleDelNewsItem(cc *ClientConn, t *Transaction) (res []Transaction, err e
 		}
 	}
 
+	if bytes.Equal(cats[delName].Type, []byte{0, 3}) {
+		if !cc.Authorize(accessNewsDeleteCat) {
+			return append(res, cc.NewErrReply(t, "You are not allowed to delete news categories.")), nil
+		}
+	} else {
+		if !cc.Authorize(accessNewsDeleteFldr) {
+			return append(res, cc.NewErrReply(t, "You are not allowed to delete news folders.")), nil
+		}
+	}
+
 	delete(cats, delName)
 
-	err = cc.Server.writeThreadedNews()
-	if err != nil {
+	if err := cc.Server.writeThreadedNews(); err != nil {
 		return res, err
 	}
 
-	// Reply params: none
-	res = append(res, cc.NewReply(t))
-
-	return res, err
+	return append(res, cc.NewReply(t)), nil
 }
 
 func HandleDelNewsArt(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessNewsDeleteArt) {
+	if !cc.Authorize(accessNewsDeleteArt) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to delete news articles."))
 		return res, err
 	}
@@ -1318,7 +1351,7 @@ func HandleDelNewsArt(cc *ClientConn, t *Transaction) (res []Transaction, err er
 // 327	News article data flavor		Currently “text/plain”
 // 333	News article data
 func HandlePostNewsArt(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessNewsPostArt) {
+	if !cc.Authorize(accessNewsPostArt) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to post news articles."))
 		return res, err
 	}
@@ -1381,7 +1414,7 @@ func HandlePostNewsArt(cc *ClientConn, t *Transaction) (res []Transaction, err e
 
 // HandleGetMsgs returns the flat news data
 func HandleGetMsgs(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessNewsReadArt) {
+	if !cc.Authorize(accessNewsReadArt) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to read news."))
 		return res, err
 	}
@@ -1392,7 +1425,7 @@ func HandleGetMsgs(cc *ClientConn, t *Transaction) (res []Transaction, err error
 }
 
 func HandleDownloadFile(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessDownloadFile) {
+	if !cc.Authorize(accessDownloadFile) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to download files."))
 		return res, err
 	}
@@ -1454,7 +1487,7 @@ func HandleDownloadFile(cc *ClientConn, t *Transaction) (res []Transaction, err
 
 // Download all files from the specified folder and sub-folders
 func HandleDownloadFolder(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessDownloadFile) {
+	if !cc.Authorize(accessDownloadFile) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to download folders."))
 		return res, err
 	}
@@ -1476,7 +1509,7 @@ func HandleDownloadFolder(cc *ClientConn, t *Transaction) (res []Transaction, er
 	fileTransfer := cc.newFileTransfer(FolderDownload, t.GetField(fieldFileName).Data, t.GetField(fieldFilePath).Data, transferSize)
 
 	var fp FilePath
-	err = fp.UnmarshalBinary(t.GetField(fieldFilePath).Data)
+	_, err = fp.Write(t.GetField(fieldFilePath).Data)
 	if err != nil {
 		return res, err
 	}
@@ -1500,13 +1533,13 @@ func HandleDownloadFolder(cc *ClientConn, t *Transaction) (res []Transaction, er
 func HandleUploadFolder(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 	var fp FilePath
 	if t.GetField(fieldFilePath).Data != nil {
-		if err = fp.UnmarshalBinary(t.GetField(fieldFilePath).Data); err != nil {
+		if _, err = fp.Write(t.GetField(fieldFilePath).Data); err != nil {
 			return res, err
 		}
 	}
 
 	// Handle special cases for Upload and Drop Box folders
-	if !authorize(cc.Account.Access, accessUploadAnywhere) {
+	if !cc.Authorize(accessUploadAnywhere) {
 		if !fp.IsUploadDir() && !fp.IsDropbox() {
 			res = append(res, cc.NewErrReply(t, fmt.Sprintf("Cannot accept upload of the folder \"%v\" because you are only allowed to upload to the \"Uploads\" folder.", string(t.GetField(fieldFileName).Data))))
 			return res, err
@@ -1533,7 +1566,7 @@ func HandleUploadFolder(cc *ClientConn, t *Transaction) (res []Transaction, err
 // Used only to resume download, currently has value 2"
 // 108	File transfer size	"Optional used if download is not resumed"
 func HandleUploadFile(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessUploadFile) {
+	if !cc.Authorize(accessUploadFile) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to upload files."))
 		return res, err
 	}
@@ -1545,13 +1578,13 @@ func HandleUploadFile(cc *ClientConn, t *Transaction) (res []Transaction, err er
 
 	var fp FilePath
 	if filePath != nil {
-		if err = fp.UnmarshalBinary(filePath); err != nil {
+		if _, err = fp.Write(filePath); err != nil {
 			return res, err
 		}
 	}
 
 	// Handle special cases for Upload and Drop Box folders
-	if !authorize(cc.Account.Access, accessUploadAnywhere) {
+	if !cc.Authorize(accessUploadAnywhere) {
 		if !fp.IsUploadDir() && !fp.IsDropbox() {
 			res = append(res, cc.NewErrReply(t, fmt.Sprintf("Cannot accept upload of the file \"%v\" because you are only allowed to upload to the \"Uploads\" folder.", string(fileName))))
 			return res, err
@@ -1662,13 +1695,13 @@ func HandleGetFileNameList(cc *ClientConn, t *Transaction) (res []Transaction, e
 
 	var fp FilePath
 	if t.GetField(fieldFilePath).Data != nil {
-		if err = fp.UnmarshalBinary(t.GetField(fieldFilePath).Data); err != nil {
+		if _, err = fp.Write(t.GetField(fieldFilePath).Data); err != nil {
 			return res, err
 		}
 	}
 
 	// Handle special case for drop box folders
-	if fp.IsDropbox() && !authorize(cc.Account.Access, accessViewDropBoxes) {
+	if fp.IsDropbox() && !cc.Authorize(accessViewDropBoxes) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to view drop boxes."))
 		return res, err
 	}
@@ -1697,7 +1730,7 @@ func HandleGetFileNameList(cc *ClientConn, t *Transaction) (res []Transaction, e
 
 // HandleInviteNewChat invites users to new private chat
 func HandleInviteNewChat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessOpenChat) {
+	if !cc.Authorize(accessOpenChat) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to request private chat."))
 		return res, err
 	}
@@ -1706,15 +1739,33 @@ func HandleInviteNewChat(cc *ClientConn, t *Transaction) (res []Transaction, err
 	targetID := t.GetField(fieldUserID).Data
 	newChatID := cc.Server.NewPrivateChat(cc)
 
-	res = append(res,
-		*NewTransaction(
-			tranInviteToChat,
-			&targetID,
-			NewField(fieldChatID, newChatID),
-			NewField(fieldUserName, cc.UserName),
-			NewField(fieldUserID, *cc.ID),
-		),
-	)
+	// Check if target user has "Refuse private chat" flag
+	binary.BigEndian.Uint16(targetID)
+	targetClient := cc.Server.Clients[binary.BigEndian.Uint16(targetID)]
+
+	flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(targetClient.Flags)))
+	if flagBitmap.Bit(userFLagRefusePChat) == 1 {
+		res = append(res,
+			*NewTransaction(
+				tranServerMsg,
+				cc.ID,
+				NewField(fieldData, []byte(string(targetClient.UserName)+" does not accept private chats.")),
+				NewField(fieldUserName, targetClient.UserName),
+				NewField(fieldUserID, *targetClient.ID),
+				NewField(fieldOptions, []byte{0, 2}),
+			),
+		)
+	} else {
+		res = append(res,
+			*NewTransaction(
+				tranInviteToChat,
+				&targetID,
+				NewField(fieldChatID, newChatID),
+				NewField(fieldUserName, cc.UserName),
+				NewField(fieldUserID, *cc.ID),
+			),
+		)
+	}
 
 	res = append(res,
 		cc.NewReply(t,
@@ -1730,7 +1781,7 @@ func HandleInviteNewChat(cc *ClientConn, t *Transaction) (res []Transaction, err
 }
 
 func HandleInviteToChat(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessOpenChat) {
+	if !cc.Authorize(accessOpenChat) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to request private chat."))
 		return res, err
 	}
@@ -1893,7 +1944,7 @@ func HandleSetChatSubject(cc *ClientConn, t *Transaction) (res []Transaction, er
 // Fields used in the reply:
 // None
 func HandleMakeAlias(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-	if !authorize(cc.Account.Access, accessMakeAlias) {
+	if !cc.Authorize(accessMakeAlias) {
 		res = append(res, cc.NewErrReply(t, "You are not allowed to make aliases."))
 		return res, err
 	}
@@ -1922,6 +1973,12 @@ func HandleMakeAlias(cc *ClientConn, t *Transaction) (res []Transaction, err err
 	return res, err
 }
 
+// HandleDownloadBanner handles requests for a new banner from the server
+// Fields used in the request:
+// None
+// Fields used in the reply:
+// 107	fieldRefNum			Used later for transfer
+// 108	fieldTransferSize	Size of data to be downloaded
 func HandleDownloadBanner(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
 	fi, err := cc.Server.FS.Stat(filepath.Join(cc.Server.ConfigDir, cc.Server.Config.BannerFile))
 	if err != nil {