From d7738b257b99385b84b15bd75dd0bd052d78d0d0 Mon Sep 17 00:00:00 2001
From: Guangcong Luo <zarelsl@gmail.com>
Date: Sun, 19 Feb 2012 20:05:35 -0500
Subject: [PATCH] Moderators can no longer alt check administrators' alts, and
 so on

---
 chat-commands.js | 10 +++++++++-
 users.js         | 17 +++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/chat-commands.js b/chat-commands.js
index 1fb4c8edd3..9e247f728d 100644
--- a/chat-commands.js
+++ b/chat-commands.js
@@ -103,8 +103,15 @@ function parseCommandLocal(user, cmd, target, room, socket, message)
 			}
 			
 			var alts = targetUser.getAlts();
+			var altGroup = targetUser.getAltGroup();
 			
 			socket.emit('console', 'User: '+targetUser.name);
+			
+			if (!user.canMod(altGroup))
+			{
+				return true;
+			}
+			
 			var output = '';
 			for (var i in targetUser.prevNames)
 			{
@@ -116,7 +123,8 @@ function parseCommandLocal(user, cmd, target, room, socket, message)
 			for (var j=0; j<alts.length; j++)
 			{
 				var targetAlt = getUser(alts[j]);
-				if (!targetAlt || !user.canMod(targetAlt)) continue;
+				if (!targetAlt || !user.canMod(targetAlt.group)) continue;
+				if (!targetAlt.named && !targetAlt.connected) continue;
 				
 				socket.emit('console', 'Alt: '+targetAlt.name);
 				output = '';
diff --git a/users.js b/users.js
index 87b096b7fe..ea9488615a 100644
--- a/users.js
+++ b/users.js
@@ -490,6 +490,23 @@ function User(name, socket, token)
 		}
 		return alts;
 	};
+	this.getAltGroup = function() {
+		var groupRanks = {'+': 1, '%': 2, '@': 3, '&': 100};
+		var group = selfP.group;
+		var groupRank = (groupRanks[group] || 0);
+		for (var i in users)
+		{
+			if (users[i].ip === selfP.ip && users[i] !== selfP)
+			{
+				if ((groupRanks[users[i].group]||0) > groupRank)
+				{
+					group = users[i].group;
+					groupRank = (groupRanks[group] || 0);
+				}
+			}
+		}
+		return group;
+	};
 	this.ban = function(noRecurse) {
 		bannedIps[selfP.ip] = selfP.userid;
 		// no need to recurse, since the root for-loop already bans everything with your IP