[JENKINS-17419] Added new configuration option to disallow bot commands from private chat.

[askeing]

No description provided.

[buildhive]

Jenkins » ircbot-plugin #2 SUCCESS
This pull request looks good
(what's this?)

[buildhive]

Jenkins » ircbot-plugin #3 SUCCESS
This pull request looks good
(what's this?)

[kutzi]

What's the reasoning for this?
Why is it a problem that commands are allowed from private chats?

[askeing]

If we want to restrict IRC bot commands to unauthorized users (JENKINS-5931), we can disable commands for a chatroom (JENKINS-11606). But unauthorized users still can send commands to ircbot by private chat.
So in my opinion, if we add configuration option to disable private, we can control the usage of commands.

[askeing]

For example:

Channels:
  - channel-notify / no-pwd / notify-only
  - channel-adm / with-pwd / disable-notify-only

Unauthorized users can get notifications in channel-notify room, and admin can control jenkins in channel-adm room.
If ircbot allow commands from private chat, although the unauthorized users cannot join channel-adm, but they still can send commands by private chat (ex: /msg ircbot !jenkins abort job).

[kutzi]

Hmm, yes I see. That's kind of a hole in the security model.
Isn't it possible to detect which chatroom a private message originated from?

[askeing]

I think there is no information about from which chatroom in private messages.
IRC Protocol: http://tools.ietf.org/rfc/rfc1459.txt