#---------------------------------------------------------------------
# strictop.tcl - version 7
# TCL script for IRC bot eggdrop
#
# This script protects against an unknown user handing out +o to
# another unknown user by deopping both of them.
# This allows an unknown user to get ops from a known user, but the
# unknown user is not allowed to give ops to other unknown users.
# Need more channel security? Switch your channel to +bitch.
#
# Only users with an n, m or o global or channel specific flag are
# allowed to to GIVE ops to both known and unknown users.
# Only users with n, m, o or f global or channel specific flag are
# allowed to GET op from a known or unknown user only.
#
# To activiate this script, the channel setting must include 
# +strictop and -bitch!
# (".chanset #channel +strictop" from the partyline)
#
# Note: if you use this script on a channel guarded by a channel
# service or another bot reopping on a deop and this service 
# is not recognised by your bot, it can trigger a +o and -o war
# between that channel service and your bot!
# Make sure your bot recognises such service/guarding bot!
#
# v0: 31-Aug-1998
# v1: 28-Sep-1998
# v2: 03-Oct-1998
# v3: 06-May-1999
# v4: 18-Mar-2002
# v5: 17-Jun-2002
# v6: 27-Jun-2002
# v7: 11-Jul-2003
# + instead of putserv, now use pushmode/flushmode
# + added package requirements (Tcl/eggdrop)
#---------------------------------------------------------------------

package require Tcl 8.0
package require eggdrop 1.6.13

#---------------------------------------------------------------------
# User defined channel flag (+strictop/-strictop)
# Binding to mode change
#---------------------------------------------------------------------

setudef flag strictop

bind mode - * enforcestrictop

#---------------------------------------------------------------------
# procedure enforcestrictop enforcs strict opping.
#---------------------------------------------------------------------

proc enforcestrictop { nick uhost handle chan args } {

   global botnick stampstrictop 

   #-----------------------------------------------------------
   # Check if it is an op mode.
   #-----------------------------------------------------------

   # below 1.3.23 passes 1 arg, otherwise 2 args. Join them.

   set modechange [join $args]

   if {[scan $modechange "+o %s" usergotop] != 1} { return 0 }

   #-----------------------------------------------------------
   # The channel flag +bitch defines NO action! (With +bitch
   # set, eggdrop will do the bitching by itself)
   # Enforce strictops on channels with +strictop.
   #-----------------------------------------------------------

   set chaninfo [channel info $chan]
   if {[lsearch -exact $chaninfo +bitch] != -1} { return 0 }
   if {[lsearch -exact $chaninfo +strictop] == -1} { return 0 }

   #-----------------------------------------------------------
   # - For all punishments (DEOP/KICK) the bot must be op.
   # - Allow the bot to hand out ops (bot doesn't have handle!)
   # - Allow user to op himself.
   # - If the bot got op, it is ok (potential problem: only
   # certain people should be allowed to op the bot, fix later)
   #-----------------------------------------------------------

   if {![botisop $chan]} {return 0}

   if {$nick == $botnick} { return 0 }

   if {$nick == $usergotop} { return 0 }

   if {$usergotop == $botnick} { return 0 }

   #-----------------------------------------------------------
   # Timestamp to avoid too many punishments in case nick 
   # does +ooo user user user
   #-----------------------------------------------------------

   if {![info exists stampstrictop]} { set stampstrictop 0 }

   set stamp "$nick $chan $modechange [unixtime]"

   if {$stamp == $stampstrictop} { return 0 }

   set stampstrictop $stamp

   #-----------------------------------------------------------
   # If a handle exists check for the flags.
   # A user with the strictopflag is allowed to GIVE ops.
   #-----------------------------------------------------------

   set strictopflag "n m o"

   foreach flag $strictopflag {
      if {[matchattr $handle $flag]} {return 0}
   }

   foreach flag $strictopflag {
      if {[matchchanattr $handle $flag $chan]} {return 0}
   }

   #-----------------------------------------------------------
   # Allow people who had op to get opped again, even if the
   # opper is an untrusted nick? default: no.
   # [wasop] introduced somewhere in eggdrop 1.4. 
   #-----------------------------------------------------------

   #if {[wasop $usergotop]} { return 0 }

   #-----------------------------------------------------------
   # Get the handle for the victim, if unknown: punish...
   #-----------------------------------------------------------

   set usergotophandle [nick2hand $usergotop $chan]

   if {![validuser $usergotophandle]} { 
      strictopdeop $chan $nick $usergotop
      return 0
   }

   #-----------------------------------------------------------
   # If a handle exists: check for the flags.
   # A user with the allowopflag is allowed to GET ops.
   #-----------------------------------------------------------

   set allowopflag "n m o f"

   foreach flag $allowopflag {
      if {[matchattr $usergotophandle $flag]} {return 0}
   }

   foreach flag $allowopflag {
      if {[matchchanattr $usergotophandle $flag $chan]} {return 0}
   }

   #-----------------------------------------------------------
   # no more excuses...
   #-----------------------------------------------------------

   strictopdeop $chan $nick $usergotop

}

#---------------------------------------------------------------------
# The deop/punish part
# Deop both the operator and the person being opped. 
# Or put kicks/bans as punishments...
#---------------------------------------------------------------------

proc strictopdeop {chan nick deopnick} {

   putlog "STRICTOP: deopping $nick and $deopnick on $chan"

#   putserv "MODE $chan -oo $nick $deopnick"

   pushmode $chan -o $nick
   pushmode $chan -o $deopnick
   flushmode $chan

}

putlog "Strictop version 7 loaded."