Prevent user with accessAnyName from change name

diff --git a/hotline/transaction_handlers.go b/hotline/transaction_handlers.go
index aa994b9ef9eb51213a2e522dc0c5cf0f09a7278c..2a817687f531ca774fac3c33641550542826699e 100644 (file)
--- a/hotline/transaction_handlers.go
+++ b/hotline/transaction_handlers.go
@@ -1593,18 +1593,17 @@ func HandleUploadFile(cc *ClientConn, t *Transaction) (res []Transaction, err er
 }
 
 func HandleSetClientUserInfo(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
-       var icon []byte
        if len(t.GetField(fieldUserIconID).Data) == 4 {
-               icon = t.GetField(fieldUserIconID).Data[2:]
+               cc.Icon = t.GetField(fieldUserIconID).Data[2:]
        } else {
-               icon = t.GetField(fieldUserIconID).Data
+               cc.Icon = t.GetField(fieldUserIconID).Data
+       }
+       if cc.Authorize(accessAnyName) {
+               cc.UserName = t.GetField(fieldUserName).Data
        }
-       cc.Icon = icon
-       cc.UserName = t.GetField(fieldUserName).Data
 
        // the options field is only passed by the client versions > 1.2.3.
        options := t.GetField(fieldOptions).Data
-
        if options != nil {
                optBitmap := big.NewInt(int64(binary.BigEndian.Uint16(options)))
                flagBitmap := big.NewInt(int64(binary.BigEndian.Uint16(cc.Flags)))
@@ -1623,14 +1622,16 @@ func HandleSetClientUserInfo(cc *ClientConn, t *Transaction) (res []Transaction,
                }
        }
 
-       // Notify all clients of updated user info
-       cc.sendAll(
-               tranNotifyChangeUser,
-               NewField(fieldUserID, *cc.ID),
-               NewField(fieldUserIconID, cc.Icon),
-               NewField(fieldUserFlags, cc.Flags),
-               NewField(fieldUserName, cc.UserName),
-       )
+       for _, c := range sortedClients(cc.Server.Clients) {
+               res = append(res, *NewTransaction(
+                       tranNotifyChangeUser,
+                       c.ID,
+                       NewField(fieldUserID, *cc.ID),
+                       NewField(fieldUserIconID, cc.Icon),
+                       NewField(fieldUserFlags, cc.Flags),
+                       NewField(fieldUserName, cc.UserName),
+               ))
+       }
 
        return res, err
 }

diff --git a/hotline/transaction_handlers_test.go b/hotline/transaction_handlers_test.go
index f2831125da58918c3be79722b983d57e16641d8e..f43d45f29ec6340c75597504ee3805a06ec1d4fa 100644 (file)
--- a/hotline/transaction_handlers_test.go
+++ b/hotline/transaction_handlers_test.go
@@ -2887,3 +2887,72 @@ func TestHandleTranAgreed(t *testing.T) {
                })
        }
 }
+
+func TestHandleSetClientUserInfo(t *testing.T) {
+       type args struct {
+               cc *ClientConn
+               t  *Transaction
+       }
+       tests := []struct {
+               name    string
+               args    args
+               wantRes []Transaction
+               wantErr assert.ErrorAssertionFunc
+       }{
+               {
+                       name: "when client does not have accessAnyName",
+                       args: args{
+                               cc: &ClientConn{
+                                       Account: &Account{
+                                               Access: func() *[]byte {
+                                                       var bits accessBitmap
+                                                       access := bits[:]
+                                                       return &access
+                                               }(),
+                                       },
+                                       ID:       &[]byte{0, 1},
+                                       UserName: []byte("Guest"),
+                                       Flags:    []byte{0, 1},
+                                       Server: &Server{
+                                               Clients: map[uint16]*ClientConn{
+                                                       uint16(1): {
+                                                               ID: &[]byte{0, 1},
+                                                       },
+                                               },
+                                       },
+                               },
+                               t: NewTransaction(
+                                       tranSetClientUserInfo, nil,
+                                       NewField(fieldUserIconID, []byte{0, 1}),
+                                       NewField(fieldUserName, []byte("NOPE")),
+                               ),
+                       },
+                       wantRes: []Transaction{
+                               {
+                                       clientID:  &[]byte{0, 1},
+                                       Flags:     0x00,
+                                       IsReply:   0x00,
+                                       Type:      []byte{0x01, 0x2d},
+                                       ID:        []byte{0, 0, 0, 0},
+                                       ErrorCode: []byte{0, 0, 0, 0},
+                                       Fields: []Field{
+                                               NewField(fieldUserID, []byte{0, 1}),
+                                               NewField(fieldUserIconID, []byte{0, 1}),
+                                               NewField(fieldUserFlags, []byte{0, 1}),
+                                               NewField(fieldUserName, []byte("Guest"))},
+                               },
+                       },
+                       wantErr: assert.NoError,
+               },
+       }
+       for _, tt := range tests {
+               t.Run(tt.name, func(t *testing.T) {
+                       gotRes, err := HandleSetClientUserInfo(tt.args.cc, tt.args.t)
+                       if !tt.wantErr(t, err, fmt.Sprintf("HandleSetClientUserInfo(%v, %v)", tt.args.cc, tt.args.t)) {
+                               return
+                       }
+
+                       tranAssertEqual(t, tt.wantRes, gotRes)
+               })
+       }
+}