egghelp/eggheads community

utimer problem

2002-10-26T14:14:17-04:00

Tcl does not evaluate strings inside { }. So your $arg wasn't being substituted. Use [list putlog "$arg"] as ppslim suggested earlier.

Statistics: Posted by stdragon — Sat Oct 26, 2002 2:14 pm

utimer problem

2002-10-26T13:10:57-04:00

NOT that i want to say that egghead isn't true, i do need some help on using $var's in a utimer

when i do:

Code:

utimer 10 { putlog "$arg" }

it tells me that $arg can't be readed...

Code:

[18:50] <^BOT^> [18:45] can't read "arg": no such variable

*) $arg was a var wich is binded to the proc's arguments when using:

Code:

bind pub - !test test_procandproc test_proc {nick host hand chan arg}

thanx in advance...
(sorry that i ask this after ur discussion)

Statistics: Posted by Guest — Sat Oct 26, 2002 1:10 pm

utimer problem

2002-10-24T09:08:01-04:00

If we are arguing over tit-for-tat, that is fine by me.

I could have quoted to heaven and hell on this post.

Initially, two replies followed: one by hah` and one by egghead.

Then your reply followed where you decided to quote a valid line of tcl out of egghead's reply, which explicitly solved sil0x0000's problem.

Yes you did, and by admiting this, you have also contradicted yourself.

In your first reply to the thread, you give 2 examples. The first example shows bad programing practice (using a variable, which I am coming up to in a min). The second, showed a exect solution to that particular problem.

However, solving one problem like this, can lead to more problems later on. What if he had wanted to use variables? The second solution would have left him stumped with a error, the first would have been bad practice as it could possibily turn into a exploit.

While I tried to get accross a point regarding variable names, I didn't use a variable in the example. Yes, I should have included one, but it's probably better to forget the variable in the example, than to use a variable in an incorrect way!

My actual goal, had not been to point out to the original poster. I had actualy replied, with a goal of alerting people giving examples (as you had done), that using such practice is incorrect and potentialy dangerous.

You state it's extreamly sloppy to post remarks about wrong and exploits. Yes, it msot probably was, but it doesn't chnage my mind regarding what I posted.

using timer and utimer in such a way, is a potential exploit. If you can teach a user the correct way before they find out there can be a issue, it's far better.

I have learned several languages in my life. Of which, I learned the proper way to use a certain few commands, that could potentialy lead to exlpoits. Now tell the truth here, if you had learned Tcl, not knowing at all about the issues that timer and utimer (taking eggdrop as an example, it's easier) can cause. One day you would have had the issue of the exlpoit, ok, simpel to replace and fix, but would you have understood why it happens when it's explained to you?

If your taught the propper way first way, with a warning of a potential exploit, you very quickly learn, how you should handle things later on.

You say my wording was sloppy, then yes it was. Though, you would have to admit, that if I said your code was sloppy, it is.

As stated, in your very first example

Code:

.tcl utimer 10 "putlog $botnick"

Now what you didn't know, is his botnick is "[die]" (example, just follow me here). If he used that code to test in the future, he would be back here trying his bot crashed (no offence).

This is the point I made, even if it was wrong to say it the way I did.

Statistics: Posted by ppslim — Thu Oct 24, 2002 9:08 am

utimer problem

2002-10-24T07:00:19-04:00

Ppslim,

sil0x0000 posted a question about ".tcl utimer 30 [putlog "time!"] ". It didn't include variables or a bind PUB context or anything.

Initially, two replies followed: one by hah` and one by egghead.

Then your reply followed where you decided to quote a valid line of tcl out of egghead's reply, which explicitly solved sil0x0000's problem.

No context was given, no other line was quoted.

Above and below that quoted line you dropped words like "wrong" and "exploit".

In my view that is a plain incorrect and sloppy thing to do!

The fact that your second reply was much, much longer, proves this point.

But now you answered:

It is you that is incorect my friend.

[snip]

SO yes, you are correct to point this out to me, but only if that first reply to the thread was not posted.

Did i mention the first reply? No. What did I say?

Dropping words like "wrong" and "exploits" around a valid line of tcl is plain incorrect and very sloppy.

Anyway, I think it is good and helpfull to others that you have elaborated on the "wrong"'s and possible "exploit"'s.

Statistics: Posted by egghead — Thu Oct 24, 2002 7:00 am

utimer problem

2002-10-24T04:50:55-04:00

It is you that is incorect my friend.

While it is true, that using

Code:

utimer 10 { putlog "time!" }

is not wrong. This is value and would work.

Code:

utimer 10 { putlog "time $testvar" }Encapsulating the - putlog "time!" - within the {&} brackets, makes a manualy created list, in which, variables are not evaluated, before going off for processing by the utimer command. As such, when the timer is eventauly called, the Tcl interpreter will then try and evaluate the variable. If there is no global scope for this var, it cuases an error.Thus, you need to pass a list to the timer command, that isn't effected by this. Ising the list command, will do this for him.The exlpoit I talked of, uses exactly the same priciple, but using a different method of passing arguments to the script.[code]bind pub - "!test" pub:test:proc pub:test {nick uh hand chan arg} {  utimer 10 "putlog $arg"  #or - utimer 10 "putlog [lindex $arg 0]" - as many like to do, when they don't know lists}

Simply typing "!test [die]" to the channel, will kill this bot. As the [die] command is being passed in excaped.

Enclosing the command in a list (using list) will prevent this sort of evaluation.

While the above is not wrong (as you pointed out), it is incorrect.

Hoever, the following was also posted, and is wrong

try
.tcl utimer 30 "putlog time!"
or
.tcl utimer 30 \[putlog "time!"\]

The first one would work, as only one word is being passed to the putlog command. As soon as you add a second, without encapsulating it into one string, in any way, you have a "putlog called with too many arguements" error. This incorrect.

The wrong item, is the second. It is the equililant of passing 3 arguements (rather than 2) to utimer. You would also receive a "extra characters after close quote" error, because of the last \].

The differance between wrong and incorrect are large. If it is incorrect, then it allready works, it's just the output may produce undesired effects (the first example wouldn't, but you add a single var to the equasion). Wrong, is simply when it doesn't work, and can't work.

SO yes, you are correct to point this out to me, but only if that first reply to the thread was not posted.

Statistics: Posted by ppslim — Thu Oct 24, 2002 4:50 am

utimer problem

2002-10-23T17:37:51-04:00

Some of the above examples are wrong, and could lead to exploits if used incorectly.

Using
Code:
.tcl utimer 10 { putlog "time!" }
While it would work without exploit, it would produce a error, if he tried to use variable names within it.

You should be using
Code:
.tcl utimer 10 [list putlog "time!"]

Dropping words like "wrong" and "exploits" around a valid line of tcl is plain incorrect and very sloppy.

It would have helped, if you had pointed out precisely and accurately what is "wrong" or "exploit"able. But now just another unexplained workaround is introduced.

Additionally, the point you are trying to make with using "variable names", does not show up in the example you gave.

Mystifications by dropping words like "wrong" and "exploit" does not help scripters to improve quality of their scripts.

Statistics: Posted by egghead — Wed Oct 23, 2002 5:37 pm

utimer problem

2002-10-23T14:04:54-04:00

Some of the above examples are wrong, and could lead to exploits if used incorectly.

Using

Code:

.tcl utimer 10 { putlog "time!" }

While it would work without exploit, it would produce a error, if he tried to use variable names within it.

You should be using

Code:

.tcl utimer 10 [list putlog "time!"]

Statistics: Posted by ppslim — Wed Oct 23, 2002 2:04 pm

utimer problem

2002-10-23T09:53:10-04:00

Thanx

Both helped the same way
TCL is still a bit confusing language sometimes....

Gr Xander...

btw Why does my syntax work on a timer and not on a utimer?

Statistics: Posted by Guest — Wed Oct 23, 2002 9:53 am

utimer problem

2002-10-23T09:46:45-04:00

In ".tcl utimer 30 [putlog "time!"]", tcl will substitute all variables and execute all commands immediately where appropriate. The result will be used when the timer expires.

Note that utimer needs a command as the second argument. An example is:

Code:

.tcl utimer 10 "putlog $botnick"

Code:

.tcl utimer 10 { putlog "time!" }

Statistics: Posted by egghead — Wed Oct 23, 2002 9:46 am

Re: utimer problem

2002-10-23T09:45:07-04:00

my utimer function seem to act weird

Code:

(15:28:18)  .tcl utimer 30 [putlog "time!"](15:28:18) <^BOT^> [15:28] time!(15:28:18) <^BOT^> Tcl: timer34

well... it acts like you tell it to do
... the [] are expanded as they're read, i.e. at the time parsing the line... and the result is used as the command for utimer (which is "").

try
.tcl utimer 30 "putlog time!"
or
.tcl utimer 30 \[putlog "time!"\]

Statistics: Posted by Guest — Wed Oct 23, 2002 9:45 am

utimer problem

2002-10-23T09:34:04-04:00

my utimer function seem to act weird, i dunno if anyone has notice this before, but my utimer doesn't wait till the time has been past, but executes the proc emidiately. Look at the following piece of my log file, where i start a utimer (30 sec) from the console(dcc).

Code:

(15:28:18)  .tcl utimer 30 [putlog "time!"](15:28:18) <^BOT^> [15:28] time!(15:28:18) <^BOT^> Tcl: timer34

U see i start a utimer for 30 seconds wich has to put "time!" into the log... but it does respond emediatly as u see at the log time...
If anyone has an idea pls help....

thanx in advance....

Statistics: Posted by Guest — Wed Oct 23, 2002 9:34 am