From a487451cc74fa11d676e2cedc23f931f031c1c49 Mon Sep 17 00:00:00 2001
From: Valentin Lorentz <progval@gmail.com>
Date: Thu, 23 Jun 2011 12:28:42 +0200
Subject: [PATCH] Todo: Add allowThirdpartyReader config variable.

---
 plugins/Todo/config.py |  3 +++
 plugins/Todo/plugin.py |  3 +++
 plugins/Todo/test.py   | 13 ++++++++++++-
 3 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/plugins/Todo/config.py b/plugins/Todo/config.py
index 2e77b0508..9aa92bae8 100644
--- a/plugins/Todo/config.py
+++ b/plugins/Todo/config.py
@@ -46,5 +46,8 @@ Todo = conf.registerPlugin('Todo')
 # conf.registerGlobalValue(Todo, 'someConfigVariableName',
 #     registry.Boolean(False, _("""Help for someConfigVariableName.""")))
 
+conf.registerGlobalValue(Todo, 'allowThirdpartyReader',
+    registry.Boolean(False, _("""Determines whether users can read the
+    todo-list of another user.""")))
 
 # vim:set shiftwidth=4 softtabstop=4 expandtab textwidth=79:
diff --git a/plugins/Todo/plugin.py b/plugins/Todo/plugin.py
index d00d46311..91a2f98e8 100644
--- a/plugins/Todo/plugin.py
+++ b/plugins/Todo/plugin.py
@@ -142,6 +142,9 @@ class Todo(callbacks.Plugin):
             u = ircdb.users.getUser(msg.prefix)
         except KeyError:
             u = None
+        if u != user and not self.registryValue('allowThirdpartyReader'):
+            irc.error(_('You are not allowed to see other users todo-list.'))
+            return
         # List the active tasks for the given user
         if not taskid:
             try:
diff --git a/plugins/Todo/test.py b/plugins/Todo/test.py
index efc4ab1bb..2567a1e0d 100644
--- a/plugins/Todo/test.py
+++ b/plugins/Todo/test.py
@@ -30,7 +30,7 @@
 from supybot.test import *
 
 class TodoTestCase(PluginTestCase):
-    plugins = ('Todo', 'User')
+    plugins = ('Todo', 'User', 'Config')
     _user1 = 'foo!bar@baz'
     _user2 = 'bar!foo@baz'
     def setUp(self):
@@ -66,6 +66,17 @@ class TodoTestCase(PluginTestCase):
         self.assertNotError('todo setpriority 1 100')
         self.assertNotError('todo setpriority 2 10')
         self.assertRegexp('todo', '#2: moo and #1: wash my car')
+        # Check permissions
+        self.prefix = self._user2
+        self.assertError('todo tester')
+        self.assertNotRegexp('todo tester', 'task id')
+        self.prefix = self._user1
+        self.assertNotError('todo tester')
+        self.assertNotError('config plugins.Todo.allowThirdpartyReader True')
+        self.prefix = self._user2
+        self.assertNotError('todo tester')
+        self.prefix = self._user1
+        self.assertNotError('todo tester')
 
     def testAddtodo(self):
         self.assertNotError('todo add code a new plugin')