xan/xenu_nntp
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prevent passing wrong number of args to POST

Browse source
This commit is contained in:
XANTRONIX Development 2024-11-30 19:57:29 -05:00
parent 61f26dd102
commit c2b2181c7f
1 changed files with 35 additions and 49 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

56
lib/nntp/tiny/session.py
View file

@ -740,37 +740,11 @@ class Session():
return True
def _cmd_post(self):
if self.perms is None or not self.perms & UserPermission.POST:
return self.respond(ResponseCode.NNTP_POST_PROHIBITED)
self.respond(ResponseCode.NNTP_INQUIRY_ARTICLE)
message = Message()
while True:
line = self.readline()
if line == '':
self.active = False
break
elif line == '.':
if self._save_message(message):
return self.respond(ResponseCode.NNTP_ARTICLE_RECEIVED)
else:
return self.respond(ResponseCode.NNTP_POST_FAILED)
elif line == '..':
line = '.'
try:
message.readline(line)
except:
return self.respond(ResponseCode.NNTP_POST_FAILED)
def _cmd_ihave(self, message_id):
def _post_impl(self, message_id=None):
if self.perms is None or not self.perms & UserPermission.POST:
return self.respond(ResponseCode.NNTP_POST_PROHIBITED)
if message_id:
sql = """
select
count(message_id)
@ -786,7 +760,13 @@ class Session():
if row is not None and row[0] > 0:
return self.respond(ResponseCode.NNTP_ARTICLE_NOT_WANTED_ID)
self.respond(ResponseCode.NNTP_INQUIRY_ARTICLE_ID)
code_inquiry = ResponseCode.NNTP_INQUIRY_ARTICLE_ID
code_received = ResponseCode.NNTP_ARTICLE_RECEIVED_ID
else:
code_inquiry = ResponseCode.NNTP_INQUIRY_ARTICLE
code_received = ResponseCode.NNTP_ARTICLE_RECEIVED
self.respond(code_inquiry)
message = Message()
@ -796,22 +776,28 @@ class Session():
if line == '':
self.active = False
break
elif line == '.':
if message.message_id != message_id:
return self.respond(ResponseCode.NNTP_POST_FAILED)
stripped = line.rstrip()
if stripped == '.':
if self._save_message(message):
return self.respond(ResponseCode.NNTP_ARTICLE_RECEIVED_ID)
return self.respond(code_received)
else:
return self.respond(ResponseCode.NNTP_POST_FAILED)
elif line == '..':
line = '.'
elif stripped == '..':
line = line[1:]
try:
message.readline(line)
except:
return self.respond(ResponseCode.NNTP_POST_FAILED)
def _cmd_post(self):
return self._post_impl()
def _cmd_ihave(self, message_id):
return self._post_impl(message_id)
def _cmd_date(self):
timestamp = datetime.datetime.now(datetime.UTC)