changed X & Y to 27 & 20 for cmd Dos protection

[spider.git] / perl / DXCommandmode.pm

diff --git a/perl/DXCommandmode.pm b/perl/DXCommandmode.pm
index 2c49fabe07cb7422ef8536efb981a5fce5c980c5..b3718721c69a843fe947c8a06d0725f0f36c37dc 100644 (file)
--- a/perl/DXCommandmode.pm
+++ b/perl/DXCommandmode.pm
@@ -50,6 +50,7 @@ use DXCIDR;
 use strict;
 use vars qw(%Cache %cmd_cache $errstr %aliases $scriptbase %nothereslug
        $maxbadcount $msgpolltime $default_pagelth $cmdimportdir $users $maxusers
+    $maxcmdlth $maxcmdcount $cmdinterval
 );
 
 %Cache = ();                                   # cache of dynamically loaded routine's mod times
@@ -63,6 +64,9 @@ $cmdimportdir = "$main::root/cmd_import"; # the base directory for importing com
                                           # this does not exist as default, you need to create it manually
 $users = 0;                                      # no of users on this node currently
 $maxusers = 0;                           # max no users on this node for this run
+$maxcmdlth = 512;                              # max length of incoming cmd line (including the command and any arguments
+$maxcmdcount = 27;                             # max no cmds entering $cmdinterval seconds
+$cmdinterval = 20;                             # if user enters more than $maxcmdcount in $cmdinterval seconds, they are logged off
 
 #
 # obtain a new connection this is derived from dxchannel
@@ -249,7 +253,12 @@ sub start
        }
 
        $self->lastmsgpoll($main::systime);
+       $self->{user_interval} = $self->user->user_interval || $main::user_interval; # allow user to change idle time between prompts
        $self->prompt;
+
+       $self->{cmdintstart} = 0; # set when systime > this + cmdinterval and a command entered, cmdcount set to 0
+       $self->{cmdcount} = 0;             # incremented on a coming in. If this value > $maxcmdcount, disconnect
+
 }
 
 #
@@ -345,22 +354,25 @@ sub normal
                        }
                        $self->state('prompt');
                        delete $self->{talklist};
-               } elsif ($cmdline =~ m|^/+\w+|) {
+               } elsif ($cmdline =~ m|^[/\w\\]+|) {
                        $cmdline =~ s|^/||;
                        my $sendit = $cmdline =~ s|^/+||;
                        if (@bad = BadWords::check($cmdline)) {
                                $self->badcount(($self->badcount||0) + @bad);
                                LogDbg('DXCommand', "$self->{call} swore: '$cmdline' with badwords: '" . join(',', @bad) . "'");
                        } else {
-                               my @in = $self->run_cmd($cmdline);
-                               $self->send_ans(@in);
-                               if ($sendit && $self->{talklist} && @{$self->{talklist}}) {
-                                       foreach my $l (@in) {
-                                               for (@{$self->{talklist}}) {
-                                                       if ($self->{state} eq 'talk') {
-                                                               $self->send_talks($_, $l);
-                                                       } else {
-                                                               send_chats($self, $_, $l)
+                               my @cmd = split /\s*\\n\s*/, $cmdline;
+                               foreach my $l (@cmd) {
+                                       my @in = $self->run_cmd($l);
+                                       $self->send_ans(@in);
+                                       if ($sendit && $self->{talklist} && @{$self->{talklist}}) {
+                                               foreach my $l (@in) {
+                                                       for (@{$self->{talklist}}) {
+                                                               if ($self->{state} eq 'talk') {
+                                                                       $self->send_talks($_, $l);
+                                                               } else {
+                                                                       send_chats($self, $_, $l)
+                                                               }
                                                        }
                                                }
                                        }
@@ -406,8 +418,25 @@ sub normal
 #              if (@bad = BadWords::check($cmdline)) {
 #                      $self->badcount(($self->badcount||0) + @bad);
 #                      LogDbg('DXCommand', "$self->{call} swore: '$cmdline' with badwords: '" . join(',', @bad) . "'");
-#              } else {
-                       $self->send_ans(run_cmd($self, $cmdline));
+               #               } else {
+               my @cmd = split /\s*\\n\s*/, $cmdline;
+               foreach my $l (@cmd) {
+
+                       # rate limiting code
+                       
+                       if (($self->{cmdintstart} + $cmdinterval <= $main::systime) || $self->{inscript}) {
+                               $self->{cmdintstart} = $main::systime;
+                               $self->{cmdcount} = 1;
+                               dbg("$self->{call} started cmdinterval") if isdbg('cmdcount');
+                       } else {
+                               if (++$self->{cmdcount} > $maxcmdcount) {
+                                       LogDbg('baduser', qq{User $self->{call} sent $self->{cmdcount} (>= $maxcmdcount) cmds in $cmdinterval seconds starting at } . atime($self->{cmdintstart}) . ", disconnected" );
+                                       $self->disconnect;
+                               }
+                               dbg("$self->{call} cmd: '$l' cmdcount = $self->{cmdcount} in $cmdinterval secs") if isdbg('cmdcount');
+                       }
+                       $self->send_ans(run_cmd($self, $l));
+               }
 #              }
        } 
 
@@ -534,15 +563,15 @@ sub run_cmd
                
        if ($cmd) {
 
-               # check cmd
-               if ($cmd =~ m|^/| || $cmd =~ m|[^-?\w/]|) {
+               # strip out // on command only
+               $cmd =~ s|//+|/|g;
+
+               # check for length of whole command line and any invalid characters
+               if (length $cmdline > $maxcmdlth || $cmd =~ m|\.| || $cmd !~ m|^\w+(?:/\w+){0,1}(?:/\d+)?$|) {
                        LogDbg('DXCommand', "cmd: $self->{call} - invalid characters in '$cmd'");
-                       return $self->_error_out('e1');
+                       return $self->_error_out('e40');
                }
 
-               # strip out // on command only
-               $cmd =~ s|//|/|g;
-                                       
                my ($path, $fcmd);
                        
                dbg("cmd: $cmd") if isdbg('command');
@@ -585,7 +614,7 @@ sub run_cmd
                                return $self->_error_out('e1');
                        }
                } else {
-                       dbg("cmd: $cmd not found") if isdbg('command');
+                       LogDbg('DXCommand', "$self->{call} cmd: '$cmd' not found");
                        return $self->_error_out('e1');
                }
        }
@@ -594,11 +623,11 @@ sub run_cmd
        if ($ok) {
                delete $self->{errors};
        } else {
-               if (++$self->{errors} > $DXChannel::maxerrors) {
+               if ($self != $main::me && ++$self->{errors} > $DXChannel::maxerrors) {
                        $self->send($self->msg('e26'));
                        $self->disconnect;
                        return ();
-               }
+               } 
        }
        return map {s/([^\s])\s+$/$1/; $_} @ans;
 }
@@ -624,7 +653,7 @@ sub process
                }
                
                # send a prompt if no activity out on this channel
-               if ($t >= $dxchan->t + $main::user_interval) {
+               if ($t >= $dxchan->t + $dxchan->{user_interval}) {
                        $dxchan->prompt() if $dxchan->{state} =~ /^prompt/o;
                        $dxchan->t($t);
                }
@@ -878,7 +907,6 @@ sub find_cmd_name {
                
                if (isdbg('eval')) {
                        my @list = split /\n/, $eval;
-                       my $line;
                        for (@list) {
                                dbg($_ . "\n") if isdbg('eval');
                        }
@@ -1379,7 +1407,7 @@ sub spawn_cmd
        no strict 'refs';
 
        # just behave normally if something has set the "one-shot" _nospawn in the channel
-       if ($self->{_nospawn}) {
+       if ($self->{_nospawn} || $main::is_win == 1) {
                eval { @out = $cmdref->(@$args); };
                if ($@) {
                        DXDebug::dbgprintring(25);