From 5bd95255a35edc8cbf243fe9e7e89ff190dc5fff Mon Sep 17 00:00:00 2001
From: Bryan Ashby <bryan@l33t.codes>
Date: Wed, 4 Nov 2015 23:04:55 -0700
Subject: [PATCH] * User.isGroupMember() can now take a string or array of
 strings to check * Add WELCOME2.ANS * Disallow "all" as a username * Check
 group membership when switching areas

---
 core/config.js        |   2 +-
 core/message_area.js  |   9 +++++++--
 core/user.js          |  14 ++++++++++++--
 mods/art/WELCOME2.ANS | Bin 0 -> 2681 bytes
 mods/menu.hjson       |   2 +-
 mods/msg_list.js      |   2 +-
 6 files changed, 22 insertions(+), 7 deletions(-)
 create mode 100644 mods/art/WELCOME2.ANS

diff --git a/core/config.js b/core/config.js
index 28d00c4f..6808857f 100644
--- a/core/config.js
+++ b/core/config.js
@@ -83,7 +83,7 @@ function getDefaultConfig() {
 			newUserNames		: [ 'new', 'apply' ],			//	Names reserved for applying
 
 			//	:TODO: Mystic uses TRASHCAN.DAT for this -- is there a reason to support something like that?
-			badUserNames		: [ 'sysop', 'admin', 'administrator', 'root' ],
+			badUserNames		: [ 'sysop', 'admin', 'administrator', 'root', 'all' ],
 		},
 
 		//	:TODO: better name for "defaults"... which is redundant here!
diff --git a/core/message_area.js b/core/message_area.js
index 7444ede0..7a22b5b0 100644
--- a/core/message_area.js
+++ b/core/message_area.js
@@ -78,8 +78,13 @@ function changeMessageArea(client, areaName, cb) {
 				}
 			},
 			function validateAccess(area, callback) {
-				//	:TODO: validate user has access to |area| -- must belong to group(s) specified
-				callback(null, area);
+				if(_.isArray(area.groups) && !
+					client.user.isGroupMember(area.groups))
+				{
+					callback(new Error('User does not have access to this area'));
+				} else {
+					callback(null, area);
+				}
 			},
 			function changeArea(area, callback) {
 				client.user.persistProperty('message_area_name', area.name, function persisted(err) {
diff --git a/core/user.js b/core/user.js
index c39a8435..ea5246c8 100644
--- a/core/user.js
+++ b/core/user.js
@@ -48,8 +48,18 @@ function User() {
 
 	this.isSysOp = this.isRoot;	//	alias
 
-	this.isGroupMember = function(groupName) {
-		return self.groups.indexOf(groupName) > -1;
+	this.isGroupMember = function(groupNames) {
+		if(_.isString(groupNames)) {
+			groupNames = [ groupNames ];
+		}
+
+		groupNames.forEach(function groupEntry(groupName) {
+			if(-1 === self.groups.indexOf(groupName)) {
+				return false;
+			}
+		});
+
+		return true;
 	};
 
 	this.getLegacySecurityLevel = function() {
diff --git a/mods/art/WELCOME2.ANS b/mods/art/WELCOME2.ANS
new file mode 100644
index 0000000000000000000000000000000000000000..cfc3ed421ac689573e238f10f3011f968efdc5e2
GIT binary patch
literal 2681
zcmb_dyN(k<5cGvuas&}h_7nDDW2B9a6G8+?NC*-~NSufUBoP0#-rt$M+utBMQB~bN
zULS<)Nxq$#epFR=&u))(zpMN1kT&c1+aBA)&Gy*zU7f0Gd&IA=1}(Ts)0DTzu1h)R
zY1*v+vRVdNxMlOIsyxqdr5h}3rb9?XY!d_T4r#=1ooIeYvkvA5OHWJ=ZrH3598TPW
zp+}f1$1T%TVVijxr`4r<<jxr=h@dBpJNd)rg;7UH$1&nD|Gi)u7}6G;zyc^sBm~|P
zKB+JO$OsisJ~$sgJV~Ev0tC<^7sqS)ERB-}Qmhd}gu4V0gF!~rhNV&>E7EzvxH`WS
zD)61~(0F@vjoNe{XTqL0>ne8K7I;mp-GQ*>KhNXHIyJp-8uQt*262MkwO-<djNmf|
zp9vjef>LO7hq>hJ5!DSQmyV0n<LNXElC%Ic@~FgcI(aSbR4(YatP>sS*>`&gtanOn
zFeE$0XN4qx^jlfca-W9c&`3lOmAC|pt{F8t5J(k4E(xLa8J$4LfKZ0P%dZ`F6iPs>
z$b=cmmY0C}c3{>h0QRi1;)_^3GE!b4NyXj?G3%sqfk?!I6U#Ni3T><bZBZ(0STQ&}
zf@$g~I~w9FCy3+meS|ekN*Jz@Yk@uL_z2uQ&H->K3t$6H;Z0@2uHrpGX-rYnjb-45
z1fd*kGIAtU)g&{EK<`=#2ATYThTJhVEQ&`r@H(}0Y$sFOf`)HZu_}>isf<_tQB4DQ
z%mkyC_7e~2hnBUh<#ah@>RWU3E|wp<2I7Qc9yv!wPyC`rpo=wP_$XV?<F>|K3nyJZ
z8XMs^Spm94D{Lt%uHTV9Dl9N+=J4ODAf*u3;0ZC_&s4lp7x0jf?H@FPgLN!96d-6@
z3LiZ#`j$g84G^e0z+qA~s3ryh*r<;9Y%m1mxBHKp_>vbkbK#je6J~;b)wW3V*euAI
z$ZwJo3*t~4+)plmT8OZ!8Q86*dH?g6<>3E<g+seo+e~{)!QDf$Q*@;u05k_&q*Nf&
zF@h^6QYvEjvR@V({BoeUmk_+`%>`xgbLq3k#bD2+mq#%l8t_d-`NI1KTw@PA7RPL~
zG_wkHta(BtGu*8CA-6|PxGOr=YtQd9o<*eP2BU__+0MR`ivtG+V@Nuevbv~ntmcr-
z_ev#|AX=z-X_#WoFD%mhb7|1n7qDRqG_6}lE_4;+p$+Qv<@2|%w?ESNUq5d*>*pV?
qKi<5qYbg4^p0;lGO;hiFKUuA=uHLVnt@J#7`|4fw>CLsR%I_cH(u$S<

literal 0
HcmV?d00001

diff --git a/mods/menu.hjson b/mods/menu.hjson
index 3b70f49a..8bb35190 100644
--- a/mods/menu.hjson
+++ b/mods/menu.hjson
@@ -1066,7 +1066,7 @@
 								}
 								{
 									value: { 1: 1 }
-									action: @menu:messageArea
+									action: @systemMethod:prevMenu
 								}
 								{
 									value: { 1: 2 }
diff --git a/mods/msg_list.js b/mods/msg_list.js
index 97b4a5ea..2404aef9 100644
--- a/mods/msg_list.js
+++ b/mods/msg_list.js
@@ -144,7 +144,7 @@ MessageListModule.prototype.mciReady = function(mciData, cb) {
 						to				: mle.toUserName,
 						ts				: moment(mle.modTimestamp).format(dateTimeFormat),
 						newIndicator	: mle.messageId > self.lastReadId ? newIndicator : '',
-					}
+					};
 				}
 
 				msgListView.setItems(_.map(self.messageList, function formatMsgListEntry(mle) {