fix: webservice dispatch syntax check

Early bailout if the command field is not specified in the POST request.

(Not doing this actually leads to an exception in the subsequent debug
because command is an Array and it can't be added to a String,
but ayway the early catch is cleaner error handling.)

Also add a TODO about a potential improvement for permission error handling.

diff --git a/lib/rbot/core/webservice.rb b/lib/rbot/core/webservice.rb
index 112ec85e7672f859b0daefe69ec8d1bce2183e8d..6f90c574717794bcef204f0b645c795ab9cf1405 100644 (file)
--- a/lib/rbot/core/webservice.rb
+++ b/lib/rbot/core/webservice.rb
@@ -531,6 +531,11 @@ class WebServiceModule < CoreBotModule
     end
 
     command = m.post['command']
+    if command.empty?
+      m.send_plaintext('wrong syntax', 400)
+      return
+    end
+
     if not m.source
       botuser = Auth::defaultbotuser
     else
@@ -544,6 +549,8 @@ class WebServiceModule < CoreBotModule
     message = Irc::PrivMessage.new(@bot, nil, user, @bot.myself, command)
 
     res = @bot.plugins.irc_delegate('privmsg', message)
+    # TODO if delegation failed due to wrong auth, it should be reported
+    # as an error, not 200 OK
 
     if m.req['Accept'] == 'application/json'
       { :reply => user.response }