runelite
Create SpectralClanMgmt plugin
(The third-party dependency was removed.)
This plugin is meant to help the Spectral clan Admin ranks perform their management duties completely in Runelite.
It allows Spectral clan members who have one of the Admin ranks to see and click on a button on the Clan Members List UI. The plugin includes a config panel with a text box where the user can enter a valid URL to receive post requests.
Clicking the button when a valid URL has not been set in the plugin's settings will display a prompt in the chatbox stating that they must enter a valid URL in the settings first in order to proceed.
If a valid URL is set in the plugin's settings, then: Clicking the button opens a prompt in the chatbox with 2 options for selecting members and 1 option for canceling. Clicking the first or second option allows the admin member to click on the name of a clan member on the Members List UI to select that member. For the first option, the admin member will select one clan member, but for the second option, the admin rank will select two members.
After each member selection, a check will run to determine if the selected member has the appropriate rank for the option the admin member selected at the start. If the selected member does not, the admin member will be prompted to either select a different member or cancel. If the selected member does have the appropriate rank, the process will continue to the next step. If the check passed after each member selection, a prompt will open in the chatbox for the admin member to confirm their selection, go back and select a different member, or cancel.
After the member selection(s) have been made, a prompt will display in the chatbox for the member to confirm they want to export the data of the clan member(s) or cancel.
If the admin member chooses to export, the join date for the selected member, or just the first selected member if the admin rank chose the second option at the start, will be retrieved and converted from a LocalDate value to a ZonedDateTime value in the "America/New_York" timezone, then converted to a string in the "M/d/yyyy" format. Also, any non-breaking space characters in the name(s) of the member(s) will be replaced with a blank space character to ensure the web app script that will receive the post request is able to perform name matches accurately.
If there is still a valid URL set in the plugin's settings at the time of the export, the name(s) of the member(s) and the one converted join date will be passed as parameters in an asynchronous post request to the URL specified in the plugin's config. The chatbox prompt will close after the post request is sent. When a response is received back from the post request, a chatbox prompt will display the results of the response, which will include if the export was successful and additional information for the admin member.
Every admin-ranked clan member will be using the plugin (if approved), so currently, the plugin will have 11 users, although the number of users would normally be at least 15.
New plugin spectralclanmgmt: https://github.com/rebelego/spectralclanmgmt/tree/854bb6b49bacbbc6fd65d3fbe5e00c6dc11e8641
![runelite-github-app[bot] avatar](https://avatars.githubusercontent.com/u/13814776?v=4 "Published by a pub.dev verified publisher"){kind=small}
I can't figure out what I need to do to stop the build from failing. The only third-party dependency I actually need is the commons-validator. Do I need to include the dependencies of that dependency or can I omit them?
Since you are only using the dependency to validate a URL, it would be easier for us if you just rolled your own validation.
That makes sense, I'll take out that dependency and add in code to do the validation.
I thought I had, I removed the files for it and any mentions of it in the code files. Is there another step I need to do to get it to register the dependency isn't there?
Oh! I see what you mean now, i'll get that fixed and push the changes as soon as I get home.
I should've perhaps made a comment earlier instead of a review, as you'll still need to wait for a maintainer before this can get merged, sorry. I can however let you know my thoughts on this after looking through your code and maybe get the ball rolling.
You will need to add a warning to your plugin manifest (as seen here), informing your users about what the plugin sends to servers not controlled by RuneLite. Note that this necessarily includes their IP address, since you're making HTTP requests.
In my opinion, it's difficult to follow exactly which data your plugin could possibly send and when. It appears like you're only ever submitting clan member names, their join dates and otherwise only string constants, but if you want to ease the review process significantly, I would recommend making it a lot easier to track down exactly what can possibly be sent in these HTTP requests.
Additionally, it appears like this can send messages in public chat and other channels on behalf of the user, seemingly only in response to the user executing one of your commands. A question which immediately came to my mind is whether this could possibly set up a tricky to spot loop of these web requests, allowing your server to send as many messages as it wants on behalf of the player, by jumping through a few hoops. Ideally this would be easy to completely rule out by glancing at the code, but in my opinion it's not that straight forward when responses to HTTP requests can make further HTTP requests, without a clearly defined flow from A to B. I should say though, I'm not well versed in how ScriptID.CHAT_SEND operates, so maybe I'm misunderstanding and this can't actually send messages on behalf of the player. A RuneLite maintainer will have a better understanding of this, and whether sending arbitrary messages on behalf of the player is acceptable.
Other than all of the above, the plugin doesn't appear to me to be malicious :+1:
I should've perhaps made a comment earlier instead of a review, as you'll still need to wait for a maintainer before this can get merged, sorry. I can however let you know my thoughts on this after looking through your code and maybe get the ball rolling.
You will need to add a warning to your plugin manifest (as seen here), informing your users about what the plugin sends to servers not controlled by RuneLite. Note that this necessarily includes their IP address, since you're making HTTP requests.
In my opinion, it's difficult to follow exactly which data your plugin could possibly send and when. It appears like you're only ever submitting clan member names, their join dates and otherwise only string constants, but if you want to ease the review process significantly, I would recommend making it a lot easier to track down exactly what can possibly be sent in these HTTP requests.
Additionally, it appears like this can send messages in public chat and other channels on behalf of the user, seemingly only in response to the user executing one of your commands. A question which immediately came to my mind is whether this could possibly set up a tricky to spot loop of these web requests, allowing your server to send as many messages as it wants on behalf of the player, by jumping through a few hoops. Ideally this would be easy to completely rule out by glancing at the code, but in my opinion it's not that straight forward when responses to HTTP requests can make further HTTP requests, without a clearly defined flow from A to B. I should say though, I'm not well versed in how
ScriptID.CHAT_SENDoperates, so maybe I'm misunderstanding and this can't actually send messages on behalf of the player. A RuneLite maintainer will have a better understanding of this, and whether sending arbitrary messages on behalf of the player is acceptable.Other than all of the above, the plugin doesn't appear to me to be malicious 👍
Thank you for the feedback! I'll be sure to add the warning as well as some more explanations to make it easier to understand!
What exactly do you need on top of the current chat box menu builder?
I'm sorry, I'm not quite sure what you mean. Do you mean the other classes I added for the chat commands?
I'm asking why you need to recreate the chatbox manager and chatbox input command classes, as we would rather you work within our API.
I'm asking why you need to recreate the chatbox manager and chatbox input command classes, as we would rather you work within our API.
The plugin needs those classes to implement the 3 chat commands that were added for our clan to use in the clan chat. The classes are modified versions (with the copyright notice) of the Runelite classes so the commands would work the way they need to.
I'm asking for an explicit reason it's needed because chat commands can be registered through the existing chat command manager, or you can use the command api with ::comands, and our chatbox menu manager has a builder api for menu inputs.
What does our exist api not do that you need?
I'm asking for an explicit reason it's needed because chat commands can be registered through the existing chat command manager, or you can use the command api with
::comands, and our chatbox menu manager has a builder api for menu inputs.What does our exist api not do that you need?
If I interpreted the code correctly, the existing API doesn't consume the command so that it won't appear at all in the chat and then send a message using a supplied string value to the chat after its consumed. Instead, commands that are handled as chatbox input will show up in the chat and only those with the plugin installed will be able to see the result of the command. The modified versions in this plugin allow for other plugins commands to be handled like normal, but the new commands won't appear in the chat at all, only the result of the command will and it will be viewable to any in the chat, even if the plugin isn't installed. The modified classes also limit the added commands to only be usable in the clan chat channel. We don't want it to be possible for any of these commands to be usable in the public chat or elsewhere, they're always consumed when used and the resulting message will only be sent if the command was used in the clan chat. The modified ChatboxCommandInput class also includes additional attributes that need to be included as part of the instance of the ChatboxCommandInput, and these wouldn't be part of the core version.
then send a message using a supplied string value to the chat after its consumed.
the new commands won't appear in the chat at all, only the result of the command will and it will be viewable to any in the chat, even if the plugin isn't installed
I believe this would fall afoul of the third-party client guidelines.
then send a message using a supplied string value to the chat after its consumed.
the new commands won't appear in the chat at all, only the result of the command will and it will be viewable to any in the chat, even if the plugin isn't installed
I believe this would fall afoul of th third-party client guidelines.
It shouldn't, since it does the same thing the ::bank command does. The core chat commands are allowable, and they replace the text of a chat message that's been sent, so I don't believe this would violate any guidelines either. The command is still sent in the game, it's simply not displayed. The new message with the intended result of the command is what becomes visible in the chat rather than the command.
since it does the same thing the ::bank command does.
::bank is built into the game, it's not a third party addition.
The core chat commands are allowable, and they replace the text of a chat message that's been sent
They only do so clientside, for people with the plugin enabled, and it makes use of an external server I believe. They don't modify the message actually sent to the game servers from what the player typed.
I'm not sure if I'm reading that correctly but we don't allow sending messages to chat created from plugins.
If you are wanting to not have public chat but have the output of the command, you would need to run your own webservice that communicates between clients when a command is sent.
since it does the same thing the ::bank command does.
::bank is built into the game, it's not a third party addition.
The core chat commands are allowable, and they replace the text of a chat message that's been sent
They only do so clientside, for people with the plugin enabled, and it makes use of an external server I believe. They don't modify the message actually sent to the game servers from what the player typed.
When I was looking through the comments in the Discord server, there was a comment (https://discord.com/channels/301497432909414422/419891709883973642/722108755793281157) from someone who wanted to enter a custom command prepended with :: in order to show a game message with a string supplied by a method only to themselves, but not show the command itself in the chat. And from the conversation, it sounded as if this was allowable. If a message is sent as a game message, I thought those would also be sent to the server, but is that not the case?
You can display results locally but you can't send results through chat to other people.
You can display results locally but you can't send results through chat to other people.
Is that always the case? For example, if the command was sent to the chat rather than have it be consumed, and then a follow up message was sent using a supplied string that was triggered by the command, would that additional message still qualify as changing the communications between the device and game world since the first message wasn't changed or removed?
Having the plugin send an additional message to the game servers wouldn't be allowed, no.
Having the plugin send an additional message to the game servers wouldn't be allowed, no.
Could you explain which rule it breaks specifically in the terms and conditions or the guidelines and how it violates the rule? I read through the terms and conditions and the third party guidelines before adding these features and there didn't seem to be anything that explicitly banned this in those documents, so an explanation would very much help me understand why this wouldn't be allowable in the plugin. I could understand if the changing communications rule was violated by consuming the command message before another message was sent to the chat, I'd assumed the server still saw the command message regardless of if it showed up in the chat. But I didn't see anything in the terms and conditions or guidelines that explicitly forbid chat messages being sent by a plugin. Are game messages not sent to the server when sent to the game chat? If they are, and they're allowed to be sent by a plugin, why would it not be allowable for a message to be sent to the other chat channels by a plugin?