Shoutbox

you may not be thinking of the same defnition of he word secure as i am in this context

If a plugin had access to the incoming text, a dodgy plugin could phone home with all of a users conversations, or something like personaly information/password harvesting, or, alter incoming text for equalliy malicious reasons.

not everyone is completely ethical, even tho, those are some of the more extreme examples.

But plugins already have access to incoming text:

* sText: the rest of the received message. You can use it to get more information about the action you want to perform.

so it could still gather info and phone home with it now.. the only malicious thing i can think of would be to alter an incoming message in such a way as to make the user recieving it give out some kind of personal info.. But i doubt someone would give out there password/credit card number to someone on there mess list etc.. and with functions such as:

sTextToSend:this parameter is optional. You can use it if you want to ask Messenger Plus! to send a new message after this one has been displayed. This WON'T modify the message  associated with the notify code, this will simply send a new one.

Isnt that already insecure? You could have a plugin that opens a backdoor or sends out an ip when a particular message is recieved. I agree that not everyone is completely ethical about stuff like this but i really dont see how this would make much difference to security.

RooJ

yes but these are only outgoing commands and tags, and incoming notifications. This is NOT access to every single message that goes through messenger

Adding the altering text function wouldnt give people access to all text going through messenger either..
it would only kick in when a certain notifycode was recieved. Just like most other plugins do.. the only difference is the plugin can alter the text sent to it if its got a certain notifycode.. and all this can do is display something different in the messenger conversation window than what was sent. No more or less secure than some of plus's other features.

Or am i just missing something obvious?

RooJ

quote:

---

Originally posted by RooJ
Damn thats annoying.. at the moment im bringing the altered text up in a msgbox to the other user, but it can really bug you when your typing alot of messages with it.

---

Hmmm i tried that time ago but it didnt work...

Hey Mike, im using this in ReceiveNotify function:

============
If (StrComp(sNotifyCode, "tcode", vbTextCompare) = 0) Then

;insert code to alter sText (there text) here

     sText = "new( " & sText & " )"
     MsgBox sText
===========
the rest is just from Patchou example and i have a small encryption routine as a test after the if statement.

Oh you can also use a boolean or whatever you prefer to stop the plugin answering your own text.

If you dont know how to do this id be glad to help.

RooJ

reading the documentation helps tbh

code:

---

//////////////////////////////////////////////////////////////////////
//                                                                    //
// Purpose: Allow special actions when a plugin text is received    //
//                                                                    //
// Definition:                                                        //
//   This function is called everytime Messenger Plus! detects a    //
//   plugin text ID in a message received from a user. This ID is    //
//     generally placed at the beginning of a text by a plugin        //
//     command to perform an action on the destination computers.        //
//     This can be used, for example, to play a sound. See the        //
//     control characters section for more information.                //
//                                                                    //
// Parameters:                                                        //
//     * sNotifyCode: this 5 character string is the notify code that //
//       was sent next to the plugin ID control character. Use it to  //
//       identify what action to perform.                                //
//     * sText: the rest of the received message. You can use it to    //
//       get more information about the action you want to perform.    //
//       However, you MUST NOT use this parameter to determine if an  //
//       action is supported by your plugin. Use sNotifyCode instead. //
//     * pParam: additional information sent by Messenger Plus!. For  //
//       more information, read the documentation of the PLUGIN_PARAM //
//       structure. iConversationWnd and sContactName are used.        //
//     * sTextToSend: this parameter is optional. You can use it if    //
//       you want to ask Messenger Plus! to send a new message after  //
//       this one has been displayed. This WON'T modify the message    //
//       associated with the notify code, this will simply send a new //
//       one. Important: the size of this buffer is 4096 characters    //
//       and it is YOUR responsability to verify that you don't write //
//       more characters to avoid memory faults.
//     * return value: if you recognized the notify code return TRUE, //
//       else, return FALSE.                                            //
//                                                                    //
// Advanced: if the plugin version returned by Initialize() is 2 or //
// above, you can specify more than one message or command in        //
// sTextToSend. Simply create new lines with # as first character   //
// (use '\n' to create new lines in your string). Up to 20 actions  //
// can be specified, each being executed at a 0.5 second interval.  //
// A different delay can even be entered for each action. After the //
// first #, just put a digit between 1 and 9 and another #.            //
//   Example: sTextToSend = "#First message\n#5#Second message"        //
//                                                                    //
// Important: keep in mind that several plugins can be installed    //
// and that a lot of text is received. If you don't support the        //
// notify code passed in parameter, you must return as fast as        //
// possible and without doing anything else.                        //
//                                                                    //
//////////////////////////////////////////////////////////////////////                     
MPPLUGIN_RETURN_BOOL ReceiveNotify(/*[in]*/  const char* sNotifyCode,
                                   /*[in]*/  const char* sText,
                                   /*[in]*/  PLUGIN_PARAM* pParam,
                                   /*[out]*/ char* sTextToSend);

---

sText is an incomming/read only variable. You cannot chnage it (yes i know this is the c++ code but the vb code is the same).

Yes you can read what the user typed, eg
[]mcodeThis is My Message
sText contains "This is My Message"

but you CANNOT change it

quote:

---

Originally posted by optimism_
but you CANNOT change it

---

for C codes:
yes, you can change it, because it's a char *, however plus discards the changes (well i've never tested to change it in C, but you can. (and if not, just remove the const keyword))

for VB ones:
yes, you can change it, because it's a local parameter, however it's declared as ByVal, that means plus won't (or shouldn't) notice you've changed it.

In any case: Anyway, in case you acomplish to change the text, plus won't use it to be displayed in teh chat window,

In both cases you will be getting a copy of the original. Presumable for c, patchou copies it into a new variable before passing it into the function or whatever. In VB it is defined as a copy

hence you CANNOT change the original text

and anyways, the original text gets dumped into msgplus independantly from the notification plugin call. The first 6 chars are stripped and then the sText gets dumped to messenger and separately the notifcation code is executed. (the order is irrelevant)

ps, choli

Actually is a const char*
this means the compiler wont let you change it unless you cast it to (char*) and if you do a cast, it will cause a runtime error, so no, you cannot change it in c at all
(so it doent have to be copied at all actually, cos theres no write access to it)

This is what i was doing....


    If (StrComp(sNotifyCode, "msgbx", vbTextCompare) = 0) Then
        Dim mymsgbox As String
        mymsgbox = sText
        MsgBox (mymsgbox)
        ReceiveNotify = True
        Exit Function
    End If


I was trying several things with the msgbox but none of them did work...