Only allow authenticated posters to post

lib/nntp/tiny/session.py

@@ -741,6 +741,9 @@ class Session():
         return True
 
     def _cmd_post(self):
+        if not self.perms & UserPermission.POST:
+            self.respond(ResponseCode.NNTP_POST_PROHIBITED
+
         self.respond(ResponseCode.NNTP_INQUIRY_ARTICLE)
 
         message = Message()
@@ -765,6 +768,9 @@ class Session():
                 return self.respond(ResponseCode.NNTP_POST_FAILED)
 
     def _cmd_ihave(self, message_id):
+        if not self.perms & UserPermission.POST:
+            self.respond(ResponseCode.NNTP_POST_PROHIBITED
+
         sql = """
             select
                 count(message_id)