From e33428688ed43123c89861151de2e9fc2218e73d Mon Sep 17 00:00:00 2001 From: Rafli <93827765+raf-li@users.noreply.github.com> Date: Mon, 5 Oct 2026 01:21:55 +0700 Subject: [PATCH 1/3] Protect shared accounts and tell their users apart The server's accounts are shared: all students log in as "murid", guests as "tamu", invitees as "hadirin", the student council as "osis". - /du: anyone on a shared account could delete it for everyone ("murid" + "/du murid" + "y" counted as deleting your own account). Accounts in the new SHARED_ACCOUNTS setting cannot be deleted via the bot, not even by admins or with --force; admins can still remove them in the TeamTalk client - Join/login spam detection keyed people by username + IP, so every student on "murid" behind the school network counted as one person. For shared accounts the key is now username/nickname + IP Co-Authored-By: Claude Opus 5.5 --- README.md | 1 + config.py | 4 ++++ docs/index.html | 1 + help_texts.py | 3 ++- tt_client.py | 33 +++++++++++++++++++++++++++++++-- 5 files changed, 39 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 97c108a..35a29bd 100644 --- a/README.md +++ b/README.md @@ -65,6 +65,7 @@ All settings live in `config.json`. Highlights: | **Lifecycle** | `CHANNEL_INACTIVITY_TIMEOUT` (`{"value": X, "unit": "days"}`), `CHANNEL_DELETION_WARNING_SECONDS` | | **Channel Rules** | `CHANNEL_CREATION_MAX_PER_USER`, limit/block messages, `CHANNEL_CREATION_BLOCKED_USERNAMES` | | **Registration** | `REGISTRATION_ALLOWED_USERNAMES`, per-IP limits/messages | +| **Shared accounts** | `SHARED_ACCOUNTS` – accounts many people log in with (default `tamu`, `murid`, `hadirin`, `osis`, `guest`): not deletable via the bot, and moderation tells their users apart by nickname + IP | | **Abuse Throttling** | `ABUSE_LOGIN_ENABLED`, `ABUSE_JOIN_ENABLED`, `ABUSE_LOGIN_COUNT`, `ABUSE_JOIN_COUNT`, `BADWORD_ABUSE_COUNT`, `ABUSE_WINDOW_SEC`, `ABUSE_TEMP_BAN_MINUTES`, `BAN_TARGET`, `ABUSE_WHITELIST_FILE`, warning message arrays | | **Message Anti-Spam** | `ANTISPAM_MESSAGE_ENABLED`, `ANTISPAM_MESSAGE_COUNT`, `ANTISPAM_MESSAGE_WINDOW_SEC`, `ANTISPAM_INTERCEPT_TYPES`, `ANTISPAM_IGNORE_ADMINS`, warning message arrays | | **Badwords** | `BADWORDS_ENABLED`, `BADWORDS_INTERCEPT_TYPES` (`"PRIVATE"`, `"CHANNEL"`, `"BROADCAST"`), `BADWORDS_FILE`, `BADWORDS_IGNORE_ADMINS`, `BADWORDS_PROFILE_CHECK_ENABLED` | diff --git a/config.py b/config.py index 74d2743..7befc10 100644 --- a/config.py +++ b/config.py @@ -89,6 +89,9 @@ CHANNEL_CREATION_BLOCKED_MESSAGE: str = "You are not permitted to create channels." REGISTRATION_ALLOWED_USERNAMES: List[str] = ["guest"] REGISTRATION_NOT_ALLOWED_MESSAGE: str = "You already have a registered account and do not need to register again." +# Accounts that many people log in with. They cannot be deleted via the bot, +# and moderation tells their users apart by nickname + IP instead of username. +SHARED_ACCOUNTS: List[str] = ["tamu", "murid", "hadirin", "osis", "guest"] REGISTRATION_IP_LIMIT: int = 1 REGISTRATION_IP_WINDOW_MINUTES: int = 2880 REGISTRATION_IP_LIMIT_MESSAGE: str = "Account creation failed: your IP has reached the registration limit. Please try again later." @@ -173,6 +176,7 @@ "CHANNEL_CREATION_BLOCKED_MESSAGE": CHANNEL_CREATION_BLOCKED_MESSAGE, "REGISTRATION_ALLOWED_USERNAMES": REGISTRATION_ALLOWED_USERNAMES, "REGISTRATION_NOT_ALLOWED_MESSAGE": REGISTRATION_NOT_ALLOWED_MESSAGE, + "SHARED_ACCOUNTS": SHARED_ACCOUNTS, "REGISTRATION_IP_LIMIT": REGISTRATION_IP_LIMIT, "REGISTRATION_IP_WINDOW_MINUTES": REGISTRATION_IP_WINDOW_MINUTES, "REGISTRATION_IP_LIMIT_MESSAGE": REGISTRATION_IP_LIMIT_MESSAGE, diff --git a/docs/index.html b/docs/index.html index f992a81..b8ce53a 100644 --- a/docs/index.html +++ b/docs/index.html @@ -81,6 +81,7 @@

Channel Creation Rules

Registration Policy

Registration Policy