octoleo/telegram-bot-bash
1
1
Fork 0
mirror of https://github.com/octoleo/telegram-bot-bash.git synced 2024-12-28 12:50:44 +00:00
Code Issues Projects Releases Wiki Activity

finalze docs for 0.6

Browse Source
This commit is contained in:
Kay Marquardt (Gnadelwartz) 2019-04-16 11:46:37 +02:00
parent 772760855d
commit 4a944d9089
7 changed files with 63 additions and 57 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

94
README.md
View File

@ -19,77 +19,83 @@ Elsewhere, consider it released under the [WTFPLv2](http://www.wtfpl.net/txt/cop
## Install bashbot
1. Go to the directory you want to install bashbot, e.g.
- your $HOME directory (install and run with your user-ID)
- /usr/local if you want to run as service
* your $HOME directory (install and run with your user-ID)
* /usr/local if you want to run as service
2. Clone the repository:
```
git clone --recursive https://github.com/topkecleon/telegram-bot-bash
```
```
git clone --recursive https://github.com/topkecleon/telegram-bot-bash
```
3. Change to directory ```telegram-bot.bash```, run ```./bashbot.sh init``` and follow the instructions. At this stage you are asked for your Bots token given by botfather.
## Update bashbot
[Download latest update zip from github](https://github.com/topkecleon/telegram-bot-bash/releases) and copy all files to bashbot dir. run ```sudo ./bashbot.sh init```.
[Download latest update zip from github](https://github.com/topkecleon/telegram-bot-bash/releases) extract all files and copy them to your bashbot dir. Now run ```sudo ./bashbot.sh init``` to setup your environment to the current release.
## Getting started
- [Create your first telegram bot](doc/1_firstbot.md)
- [Make your own Bot](doc/2_usage.md)
- Managing your own Bot
- Recieve data
- Send Messages
- Send files, location etc.
- [Advanced Features](doc/3_advanced.md)
- Access Control
- Interactive Chats
- Background Jobs
- Inline queries
- [Expert Use](doc/4_expert.md)
- Handling UTF-8
- Run as other user or system service
- Scedule bashbot from Cron
- [Best Practices](doc/5_practice.md)
- Customizing commands.sh
- Seperate Bot logic from command
- Test your Bot with shellcheck
- [Bashbot functions reference](doc/6_reference.md)
* [Create Telegram Bot with botfather](doc/1_firstbot.md)
* [Getting Started](doc/2_usage.md)
* Managing your Bot
* Recieve data
* Send Messages
* Send files, location etc.
* [Advanced Features](doc/3_advanced.md)
* Access Control
* Interactive Chats
* Background Jobs
* Inline queries
* [Expert Use](doc/4_expert.md)
* Handling UTF-8
* Run as other user or system service
* Scedule bashbot from Cron
* [Best Practices](doc/5_practice.md)
* Customizing commands.sh
* Seperate Bot logic from command
* Test your Bot with shellcheck
* [Bashbot functions reference](doc/6_reference.md)
## Note on Keyboards
To make use of Keyboards easyer we changed the format of ```send_keyboard``` and ```send_message "mykeyboardstartshere ..."```.
Now you must provide the keyboards in Telegram JSON Array style "[ \"yes\" , \"no\" ]".
The advantage is that you can create every type of keyboard without relying on bashbot ```send_keyboard``` functionality.
**This is incompatible with keyboards in bashbot versions older than 0.6!**
To make use of Keyboards easier the keybord format for ```send_keyboard``` and ```send_message "mykeyboardstartshere ..."``` was changed.
Keybords are now defined in an JSON Array notation e.g. "[ \\"yes\\" , \\"no\\" ]".
This has the advantage that you can create any type of keyboard supported by Telegram.
**This is incompatible change for keyboards used in older bashbot versions**
*Example Keyboards*:
- Yes No in one row: "[ \"yes\" , \"no\" ]"
- Yes No ind two rows: "[ \"yes\" ] , [ \"no\" ]"
- numpad keyboard: "[ \"1\" , \"2\" , \"3\" ] , [ \"4\" , \"5\" , \"6\" ] , [ \"7\" , \"8\" , \"9\" ] , [ \"0\" ]"
- yes no in one row
- OLD format: "yes" "no" (two strings)
- NEW format: "[ \\"yes\\" , \\"no\\" ]" (one string with array)
- new keybord layouts, no possible with old format:
- Yes No in two rows: "[ \\"yes\\" ] , [ \\"no\\" ]"
- numpad style keyboard: "[ \\"1\\" , \\"2\\" , \\"3\\" ] , [ \\"4\\" , \\"5\\" , \\"6\\" ] , [ \\"7\\" , \\"8\\" , \\"9\\" ] , [ \\"0\\" ]"
## Security Considerations
Running a Telegram Bot means you are conneted to the public, you never know whats send to your Bot.
Running a Telegram Bot means it is conneted to the public and you never know whats send to your Bot.
Bash scripts in general are not designed to be bullet proof, so consider this Bot as a proof of concept. More concret examples of security problems is bash's 'quoting hell' and globbing. [Implications of wrong quoting](https://unix.stackexchange.com/questions/171346/security-implications-of-forgetting-to-quote-a-variable-in-bash-posix-shells)
Whenever you are processing input from outside your bot you should disable globbing (set -f) and carefully quote everthing.
Whenever you are processing input from from untrusted sources (messages, files, network) you mustbe be as carefull as possible, e.g. disable globbing (set -f) and quote everthing.
To improve you scripts we recommend to lint them with [shellcheck](https://www.shellcheck.net/). This can be done online or you can [install shellcheck locally](https://github.com/koalaman/shellcheck#installing). bashbot itself is also linted by shellcheck.
A powerful tool to improve your scripts robustness is [shellcheck](https://www.shellcheck.net/). You can use it online or [install shellcheck locally](https://github.com/koalaman/shellcheck#installing). All bashbot scripts are checked by shellcheck.
### Run your Bot as a restricted user
Every file your bot can write is in danger to be overwritten/deleted, In case of bad handling of user input every file your Bot can read is in danger of being disclosed.
It's important to run your bot as a user, with almost no access rights!
Never run your Bot as root, this is the most dangerous you can do! Usually the user 'nobody' has almost no rigths on Unix/Linux systems. See Expert use on how to run your Bot as an other user.
All files your Bot can write are in danger to be overwritten/deleted if your bot can be abused.
Every file your Bot can read is in danger of being disclosed for the same reason.
**Never run your Bot as root, this is the most dangerous you can do!** Usually the user 'nobody' has almost no rigths on Unix/Linux systems. See Expert use on how to run your Bot as an other user.
### Secure your Bot installation
Everyone who can read your Bot files can extract your Bots data. Especially your Bot Token in ```token``` must be protected against other users. No one exept you should have write access to the Bot files. The Bot itself need write access to ```count``` and ```tmp-bot-bash``` only, all other files should be write protected.
You Bot configuration contains data which should not be readable from other users.
Runing ```./bashbot.sh init``` sets the Bot permissions to reasonable default values as a starting point.
Everyone who can read your Bot files can extract your Bots secret data. Especially your Bot Token in ```token``` must be protected against other users. No one exept you should have write access to the Bot files. The Bot itself can be restricted to have write access to ```count``` and ```tmp-bot-bash``` only, all other files should be write protected.
To set access rights for your telegram-bot-bash directory to reasonable default values you should run ```sudo ./bashbot.sh init``` after every update or change to your installation directory.
### Is this Bot insecure?
No - its not less (in)secure as any other Bot written in any other language. But you should know about the implications ...
Bashbot is no more insecure as any other Bot written in any other language. But since YOU change the bot commands and run the Bot, you should know about the implications ...
## That's it!
If you feel that there's something missing or if you found a bug, feel free to submit a pull request!
#### $$VERSION$$ v0.60-rc2-0-gc581932
#### $$VERSION$$ v0.60-rc2-2-g7727608

4
doc/1_firstbot.md
View File

@ -1,5 +1,5 @@
## Create your first telegram bot
## Create a Telegram Bot with botfather
1. Message @botfather https://telegram.me/botfather with the following
text: `/newbot`
@ -70,5 +70,5 @@ git clone --recursive https://github.com/topkecleon/telegram-bot-bash
```
3. Change to directory ```telegram-bot.bash```, run ```./bashbot.sh init``` and follow the instructions. At this stage you are asked for your Bots token given by botfather.
#### $$VERSION$$ v0.60-rc2-0-gc581932
#### $$VERSION$$ v0.60-rc2-2-g7727608

4
doc/2_usage.md
View File

@ -1,4 +1,4 @@
## Make your own Bot
## Gettting Started
All Commands for the Bot are in the ```commands.sh``` file (this should ease upgrades of the bot core). Here you find some examples how to process messages and send out text.
@ -154,6 +154,6 @@ Allowed values: typing for text messages, upload_photo for photos, record_video
send_action "${CHAT[ID]}" "action"
```
#### $$VERSION$$ v0.60-rc2-0-gc581932
#### $$VERSION$$ v0.60-rc2-2-g7727608

2
doc/3_advanced.md
View File

@ -153,5 +153,5 @@ To send stickers through an *inline query*:
answer_inline_query "$iQUERY_ID" "cached_sticker" "identifier for the sticker"
```
#### $$VERSION$$ v0.60-rc2-0-gc581932
#### $$VERSION$$ v0.60-rc2-2-g7727608

2
doc/4_expert.md
View File

@ -102,5 +102,5 @@ An example crontab is provided in ```bashbot.cron```.
- if you run bashbot as an other user or a system service edit ```bashbot.cron``` to fit your needs and replace username```nobody``` with the username you want to run bashbot. copy the modified file to ```/etc/cron.d/bashbot```
#### $$VERSION$$ v0.60-rc2-0-gc581932
#### $$VERSION$$ v0.60-rc2-2-g7727608

2
doc/5_practice.md
View File

@ -112,5 +112,5 @@ In bashbot.sh line 490:
Here are two warnings in bashbots scripts. The first is a hint you may use shell substitions instead of sed, this is really possible and much faster!
The second warning is about an unused variable, this is true because in our examples CONTACT is not used but assigned in case you want to use it :-)
#### $$VERSION$$ v0.60-rc2-0-gc581932
#### $$VERSION$$ v0.60-rc2-2-g7727608

12
doc/6_reference.md
View File

@ -111,15 +111,15 @@ send_file "${CHAT[ID]}" "https://www.domain,com/something.gif" "Something"
----
##### send_keyboard
Note: since version 0.6 send_keyboard was changed to use native "JSON Array" as used from Telegram.
Note: since version 0.6 send_keyboard was changed to use native "JSON Array" notation as used from Telegram. Eexample Keybord Array definitions:
*usage:* send_keyboard "chat-id" "keyboard"
*example:*
```bash
send_keyboard "${CHAT[ID]}" "[ \"yes\" , \"no\" ]"
send_keyboard "${CHAT[ID]}" "[ \"yes\" ] , [ \"no\" ]"
send_keyboard "${CHAT[ID]}" "[ \"1\" , \"2\" , \"3\" ] , [ \"4\" , \"5\" , \"6\" ] , [ \"7\" , \"8\" , \"9\" ] , [ \"0\" ]"
send_keyboard "${CHAT[ID]}" "[ \\"yes\" , \\"no\" ]""
send_keyboard "${CHAT[ID]}" "[ \\"yes\\" ] , [ \\"no\\" ]"
send_keyboard "${CHAT[ID]}" "[ \\"1\\" , \\"2\\" , \\"3\\" ] , [ \\"4\\" , \\"5\\" , \\"6\\" ] , [ \\"7\\" , \\"8\\" , \\"9\\" ] , [ \\"0\\" ]"
```
##### remove_keyboard
@ -325,5 +325,5 @@ The name of your bot is availible as bash variable "$ME", there is no need to ca
##### inproc
Send Input from Telegram to waiting Interactive Chat.
#### $$VERSION$$ v0.60-rc2-0-gc581932
#### $$VERSION$$ v0.60-rc2-2-g7727608