Guard admin check against a non-list "admins" config value

Config() never actually fails validation (the preserve_errors dict is
truthy), so "admins = TRex" without the trailing comma stays a str and
"nick in admins" would have been a substring match.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KJp2rEnVtsgbH7FLj3jubx

diff --git a/src/distbot/plugins/plugin_help.py b/src/distbot/plugins/plugin_help.py
index ec18bae59ef7c104a8ed4cae7df3690beed087e5..1ab2be87af4dfcb5f9418194b38693db357f0949 100644 (file)
--- a/src/distbot/plugins/plugin_help.py
+++ b/src/distbot/plugins/plugin_help.py
@@ -56,7 +56,12 @@ class Plugins(Worker):
 
     def set_plugin_state(self, msg, plugin_name: str, enabled: bool) -> Action:
         nick = get_nick_from_message(msg)
-        if nick not in (conf_get("admins") or []):
+        admins = conf_get("admins") or []
+        if isinstance(admins, str):
+            # "admins = TRex" without the trailing comma fails string_list validation, but
+            # Config() doesn't enforce it, so guard against "in <str>" turning into a substring check
+            admins = [admins]
+        if nick not in admins:
             return Action(msg="{}: you are not allowed to do that".format(nick))
 
         resolved = self.resolve_plugin_name(plugin_name)

diff --git a/tests/test_unit/test_plugin_toggle.py b/tests/test_unit/test_plugin_toggle.py
index ed3c5442d9af9f58783f73f7e29591804afd944f..b92a2d332864029d9a9328c5a1c8ccae8c006a6e 100644 (file)
--- a/tests/test_unit/test_plugin_toggle.py
+++ b/tests/test_unit/test_plugin_toggle.py
@@ -70,3 +70,12 @@ def test_cannot_deactivate_the_toggle_plugin_itself(helper, state):
     result = _run(helper, ["nick", "plugin", "deactivate", "plugins"])
     assert result == Action(msg="nice try, but then nobody could reactivate anything")
     assert state == {}
+
+
+def test_single_admin_without_trailing_comma_is_not_a_substring_match(helper, state, monkeypatch):
+    # configobj leaves "admins = TRex" as a plain string; "Rex" must not pass as admin then
+    monkeypatch.setattr(plugin_help, "conf_get", lambda key: "TRex" if key == "admins" else None)
+    assert _run(helper, ["nick", "plugin", "deactivate", "dice"], sender="room@conf/Rex") == \
+        Action(msg="Rex: you are not allowed to do that")
+    assert _run(helper, ["nick", "plugin", "deactivate", "dice"], sender="room@conf/TRex") == \
+        Action(msg="dice deactivated")