Error in ban command

[JamoBox]

Line 91 in Channel.java appears to try and ban a user by their ident, however it is getting their nick instead of their username. This can cause problems when people have different nicks from their usernames.

Line 91:

 this.setMode("+b *!" + user.getNick() + "@*");

When banning foobar!Username@somehost.com in this way it will not effect the user "foobar" as it does not match his ident.

To correct this, you should either use the getUserName() method instead of the getNick() method, or change the ban string so it bans the user's nick instead:

this.setMode("+b " + user.getNick() + "!*@*");

[sorcix]

You're right, I'll update this, thanks!

[sorcix]

Some User objects contain only a nickname, so using getUserName() is not an option. If more user details are available, banning on hostname will work. I don't think it's necessary to check if getUserName() is available.

[JamoBox]

Some User objects contain only a nickname - Couldn't data such as usernames be populated by a simple whois to the server about the client? Only considering this as nick bans are generally very weak and bypassed by a simple nick change.

[sorcix]

In that case we need to delay the actual ban command and wait for whois response, but that would work.

Another way of doing this is improving the user list in channels. Currently sIRC keeps track of user modes for every user inside a channel, and we have full identification for users that joined after we did. However, the userlist sent when we join the channel only mentions nicknames. We could update that list when the user says something (as messages contain identification).

[sorcix]

And currently the ban method doesn't even check if there is information about the user in the userlist. That definitely has to change.

[JamoBox]

I think it would be a better idea pro-actively looking for user data separately rather than waiting for a whois response in the ban method. When a ban is issued it should be carried out as fast as possible, therefore waiting for the whois response inside the ban method itself seems a bad idea.

I'm not sure of the efficiency of this, but I know some IRC clients will populate user information by sending a whois to the server with a comma-separated list of all names on the channel it just joined (keeping in mind the number of users in the channel should be considered before doing this). In the information the IRC server will reply will be the RPL_WHOISUSER response which will have the user's username in.

The format of the RPL_WHOISUSER looks like this : "<nick> <user> <host> * :<real name>".

I'm not sure if there is a way to just extract this information to save doing a full whois, but the above should be worth considering.

src: https://www.rfc-editor.org/rfc/rfc1459.txt