lol bit of a bug found and an error

[TMM]

i get this error

lua error:
(string "scripts/trickerbot.lua"]:40: attempt to index global 'settings'
<a nil value>

tonns of times

also there is a bug, lets u fake users, really easily

but i will only tell the boss the details and he can say wether to mention or not

[Sedulus]

1) yeah, you should've gotten that error by version 016 already. if you read the changelog, you would have seen that all lua functions/globals are now moved to a dchpp namespace. settings should now be referenced as dchpp.settings.

2) this still is a private forum, so only the dch++ hubowners are reading this, but if you still insist on not posting it, please send me a private message.

[TMM]

i am starting at 0.16

erm using your version 2 scripts, im good but lua is really crazy 2 me.

oksy fsir enough

the bug is prob everyone has spotted it but the hub has no limit on amount of times u can be in hub.

unlike nmdchub it only allows 4

so i just used a simple method with dcstressor, made it so timer was really friggin large, and the users with share dont leave hub, all bots that check hubs for fake counts will think its okay.

but this is nothing with dcstressor i mearly used it to test the hub
but anyone with time and knowledege could make it log in 100's of users, all with diff names share etc and be on list, then close the app and take away users till list refreshes...... u show in list as so many users
and when users come to hub its just normal....

but as usuall im prob way behind..... but busy busy busy ya know

cya

[Sedulus]

if I understand correctly,
you say that it is legal to log in 100s of times from the same IP.
in theory there is nothing wrong with that.

perhaps an upper limit could be implemented, but that is a feature request, it's not a bug.

correct me if I understood you wrong.

[TMM]

i dont get it, you should not be able to log into ya hub lots and lots of times especially when ya can hide things like bots and opchannel.

see if you can log in, with one line of code---- and make your 1 log in show as whatever number u choose,

then why is stopping this a feature....

does dch++ go down as a fakers hub, like aomew others have......??????

[Sedulus]

I seem to have misunderstood you then.

one line of code... what line of code?

could you explain, protocol-wise, where the flaw is?

[TMM]

well basically i use dcstressor

http://www.lwave.ca/shasta/

you just execute the java app and thats it
hundred or whatever users go in hub, search, chat, pm etc i did this to test the hub out, however i dont know java but im sure that this is what could happen......

a plugin is made so that no level of user see's the name say "fakeuser "
or any name containing "fakeuser"

the stressor and java code is altered to stop the timer running out anytime soon

the code in java is altered to allow more than 100 users,

and then its executed all the users see is the fact share and user count has risen by so amount

end result will be.......

registration user count is Users+fake users = highter in list

i may be talking french but there is alot of clever gets out there,
only way to stop this been taken advantage of is to actually stop a person been able to log into a hub more than say 4 times..

also imagine this, the hub goes out, and spammers decide to change the message to advertise a hub, so instead of the fake users saying hello in chat....
they say come to this hub..
loads of times

or as more know "file sharing is illegal"
spamming the hub, and in somecases crashes the hub, or making the hub drop real users.

fake names will be

test1
test2
test3
test4
etc

in chat will be

<test> hello test1
<test5> hello test9

or
<spam> file share is illegal
<spam1> file sharing is illegal

etc