From: Thorsten <mail@aero2k.de>
Date: Fri, 11 Sep 2026 10:47:18 +0000 (+0200)
Subject: Guard admin check against a non-list "admins" config value
X-Git-Url: https://git.aero2k.de/?a=commitdiff_plain;h=53c1cf805f07a84c0bfb568d1687061e7da657b2;p=urlbot-v3.git

Guard admin check against a non-list "admins" config value

Config() never actually fails validation (the preserve_errors dict is
truthy), so "admins = TRex" without the trailing comma stays a str and
"nick in admins" would have been a substring match.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KJp2rEnVtsgbH7FLj3jubx
---

diff --git a/src/distbot/plugins/plugin_help.py b/src/distbot/plugins/plugin_help.py
index ec18bae..1ab2be8 100644
--- a/src/distbot/plugins/plugin_help.py
+++ b/src/distbot/plugins/plugin_help.py
@@ -56,7 +56,12 @@ class Plugins(Worker):
 
     def set_plugin_state(self, msg, plugin_name: str, enabled: bool) -> Action:
         nick = get_nick_from_message(msg)
-        if nick not in (conf_get("admins") or []):
+        admins = conf_get("admins") or []
+        if isinstance(admins, str):
+            # "admins = TRex" without the trailing comma fails string_list validation, but
+            # Config() doesn't enforce it, so guard against "in <str>" turning into a substring check
+            admins = [admins]
+        if nick not in admins:
             return Action(msg="{}: you are not allowed to do that".format(nick))
 
         resolved = self.resolve_plugin_name(plugin_name)
diff --git a/tests/test_unit/test_plugin_toggle.py b/tests/test_unit/test_plugin_toggle.py
index ed3c544..b92a2d3 100644
--- a/tests/test_unit/test_plugin_toggle.py
+++ b/tests/test_unit/test_plugin_toggle.py
@@ -70,3 +70,12 @@ def test_cannot_deactivate_the_toggle_plugin_itself(helper, state):
     result = _run(helper, ["nick", "plugin", "deactivate", "plugins"])
     assert result == Action(msg="nice try, but then nobody could reactivate anything")
     assert state == {}
+
+
+def test_single_admin_without_trailing_comma_is_not_a_substring_match(helper, state, monkeypatch):
+    # configobj leaves "admins = TRex" as a plain string; "Rex" must not pass as admin then
+    monkeypatch.setattr(plugin_help, "conf_get", lambda key: "TRex" if key == "admins" else None)
+    assert _run(helper, ["nick", "plugin", "deactivate", "dice"], sender="room@conf/Rex") == \
+        Action(msg="Rex: you are not allowed to do that")
+    assert _run(helper, ["nick", "plugin", "deactivate", "dice"], sender="room@conf/TRex") == \
+        Action(msg="dice deactivated")