octoleo/telegram-bot-bash
1
1
Fork 0
mirror of https://github.com/octoleo/telegram-bot-bash.git synced 2024-12-31 22:01:46 +00:00
Code Issues Projects Releases Wiki Activity

finalze docs for 0.6

Browse Source
This commit is contained in:
Kay Marquardt (Gnadelwartz) 2019-04-16 11:46:37 +02:00
parent 772760855d
commit 4a944d9089
7 changed files with 63 additions and 57 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

94
README.md
View File

@ -19,77 +19,83 @@ Elsewhere, consider it released under the [WTFPLv2](http://www.wtfpl.net/txt/cop
## Install bashbot ## Install bashbot
1. Go to the directory you want to install bashbot, e.g. 1. Go to the directory you want to install bashbot, e.g.
- your $HOME directory (install and run with your user-ID) * your $HOME directory (install and run with your user-ID)
- /usr/local if you want to run as service * /usr/local if you want to run as service
2. Clone the repository: 2. Clone the repository:
``` ```
git clone --recursive https://github.com/topkecleon/telegram-bot-bash git clone --recursive https://github.com/topkecleon/telegram-bot-bash
``` ```
3. Change to directory ```telegram-bot.bash```, run ```./bashbot.sh init``` and follow the instructions. At this stage you are asked for your Bots token given by botfather. 3. Change to directory ```telegram-bot.bash```, run ```./bashbot.sh init``` and follow the instructions. At this stage you are asked for your Bots token given by botfather.
## Update bashbot ## Update bashbot
[Download latest update zip from github](https://github.com/topkecleon/telegram-bot-bash/releases) and copy all files to bashbot dir. run ```sudo ./bashbot.sh init```. [Download latest update zip from github](https://github.com/topkecleon/telegram-bot-bash/releases) extract all files and copy them to your bashbot dir. Now run ```sudo ./bashbot.sh init``` to setup your environment to the current release.
## Getting started ## Getting started
- [Create your first telegram bot](doc/1_firstbot.md) * [Create Telegram Bot with botfather](doc/1_firstbot.md)
- [Make your own Bot](doc/2_usage.md) * [Getting Started](doc/2_usage.md)
- Managing your own Bot * Managing your Bot
- Recieve data * Recieve data
- Send Messages * Send Messages
- Send files, location etc. * Send files, location etc.
- [Advanced Features](doc/3_advanced.md) * [Advanced Features](doc/3_advanced.md)
- Access Control * Access Control
- Interactive Chats * Interactive Chats
- Background Jobs * Background Jobs
- Inline queries * Inline queries
- [Expert Use](doc/4_expert.md) * [Expert Use](doc/4_expert.md)
- Handling UTF-8 * Handling UTF-8
- Run as other user or system service * Run as other user or system service
- Scedule bashbot from Cron * Scedule bashbot from Cron
- [Best Practices](doc/5_practice.md) * [Best Practices](doc/5_practice.md)
- Customizing commands.sh * Customizing commands.sh
- Seperate Bot logic from command * Seperate Bot logic from command
- Test your Bot with shellcheck * Test your Bot with shellcheck
- [Bashbot functions reference](doc/6_reference.md) * [Bashbot functions reference](doc/6_reference.md)
## Note on Keyboards ## Note on Keyboards
To make use of Keyboards easyer we changed the format of ```send_keyboard``` and ```send_message "mykeyboardstartshere ..."```. To make use of Keyboards easier the keybord format for ```send_keyboard``` and ```send_message "mykeyboardstartshere ..."``` was changed.
Now you must provide the keyboards in Telegram JSON Array style "[ \"yes\" , \"no\" ]". Keybords are now defined in an JSON Array notation e.g. "[ \\"yes\\" , \\"no\\" ]".
The advantage is that you can create every type of keyboard without relying on bashbot ```send_keyboard``` functionality. This has the advantage that you can create any type of keyboard supported by Telegram.
**This is incompatible with keyboards in bashbot versions older than 0.6!** **This is incompatible change for keyboards used in older bashbot versions**
*Example Keyboards*: *Example Keyboards*:
- Yes No in one row: "[ \"yes\" , \"no\" ]" - yes no in one row
- Yes No ind two rows: "[ \"yes\" ] , [ \"no\" ]" - OLD format: "yes" "no" (two strings)
- numpad keyboard: "[ \"1\" , \"2\" , \"3\" ] , [ \"4\" , \"5\" , \"6\" ] , [ \"7\" , \"8\" , \"9\" ] , [ \"0\" ]" - NEW format: "[ \\"yes\\" , \\"no\\" ]" (one string with array)
- new keybord layouts, no possible with old format:
- Yes No in two rows: "[ \\"yes\\" ] , [ \\"no\\" ]"
- numpad style keyboard: "[ \\"1\\" , \\"2\\" , \\"3\\" ] , [ \\"4\\" , \\"5\\" , \\"6\\" ] , [ \\"7\\" , \\"8\\" , \\"9\\" ] , [ \\"0\\" ]"
## Security Considerations ## Security Considerations
Running a Telegram Bot means you are conneted to the public, you never know whats send to your Bot. Running a Telegram Bot means it is conneted to the public and you never know whats send to your Bot.
Bash scripts in general are not designed to be bullet proof, so consider this Bot as a proof of concept. More concret examples of security problems is bash's 'quoting hell' and globbing. [Implications of wrong quoting](https://unix.stackexchange.com/questions/171346/security-implications-of-forgetting-to-quote-a-variable-in-bash-posix-shells) Bash scripts in general are not designed to be bullet proof, so consider this Bot as a proof of concept. More concret examples of security problems is bash's 'quoting hell' and globbing. [Implications of wrong quoting](https://unix.stackexchange.com/questions/171346/security-implications-of-forgetting-to-quote-a-variable-in-bash-posix-shells)
Whenever you are processing input from outside your bot you should disable globbing (set -f) and carefully quote everthing. Whenever you are processing input from from untrusted sources (messages, files, network) you mustbe be as carefull as possible, e.g. disable globbing (set -f) and quote everthing.
To improve you scripts we recommend to lint them with [shellcheck](https://www.shellcheck.net/). This can be done online or you can [install shellcheck locally](https://github.com/koalaman/shellcheck#installing). bashbot itself is also linted by shellcheck. A powerful tool to improve your scripts robustness is [shellcheck](https://www.shellcheck.net/). You can use it online or [install shellcheck locally](https://github.com/koalaman/shellcheck#installing). All bashbot scripts are checked by shellcheck.
### Run your Bot as a restricted user ### Run your Bot as a restricted user
Every file your bot can write is in danger to be overwritten/deleted, In case of bad handling of user input every file your Bot can read is in danger of being disclosed. It's important to run your bot as a user, with almost no access rights!
Never run your Bot as root, this is the most dangerous you can do! Usually the user 'nobody' has almost no rigths on Unix/Linux systems. See Expert use on how to run your Bot as an other user. All files your Bot can write are in danger to be overwritten/deleted if your bot can be abused.
Every file your Bot can read is in danger of being disclosed for the same reason.
**Never run your Bot as root, this is the most dangerous you can do!** Usually the user 'nobody' has almost no rigths on Unix/Linux systems. See Expert use on how to run your Bot as an other user.
### Secure your Bot installation ### Secure your Bot installation
Everyone who can read your Bot files can extract your Bots data. Especially your Bot Token in ```token``` must be protected against other users. No one exept you should have write access to the Bot files. The Bot itself need write access to ```count``` and ```tmp-bot-bash``` only, all other files should be write protected. You Bot configuration contains data which should not be readable from other users.
Runing ```./bashbot.sh init``` sets the Bot permissions to reasonable default values as a starting point. Everyone who can read your Bot files can extract your Bots secret data. Especially your Bot Token in ```token``` must be protected against other users. No one exept you should have write access to the Bot files. The Bot itself can be restricted to have write access to ```count``` and ```tmp-bot-bash``` only, all other files should be write protected.
To set access rights for your telegram-bot-bash directory to reasonable default values you should run ```sudo ./bashbot.sh init``` after every update or change to your installation directory.
### Is this Bot insecure? ### Is this Bot insecure?
No - its not less (in)secure as any other Bot written in any other language. But you should know about the implications ... Bashbot is no more insecure as any other Bot written in any other language. But since YOU change the bot commands and run the Bot, you should know about the implications ...
## That's it! ## That's it!
If you feel that there's something missing or if you found a bug, feel free to submit a pull request! If you feel that there's something missing or if you found a bug, feel free to submit a pull request!
#### $$VERSION$$ v0.60-rc2-0-gc581932 #### $$VERSION$$ v0.60-rc2-2-g7727608

4
doc/1_firstbot.md
View File

@ -1,5 +1,5 @@
## Create your first telegram bot ## Create a Telegram Bot with botfather
1. Message @botfather https://telegram.me/botfather with the following 1. Message @botfather https://telegram.me/botfather with the following
text: `/newbot` text: `/newbot`
@ -70,5 +70,5 @@ git clone --recursive https://github.com/topkecleon/telegram-bot-bash
``` ```
3. Change to directory ```telegram-bot.bash```, run ```./bashbot.sh init``` and follow the instructions. At this stage you are asked for your Bots token given by botfather. 3. Change to directory ```telegram-bot.bash```, run ```./bashbot.sh init``` and follow the instructions. At this stage you are asked for your Bots token given by botfather.
#### $$VERSION$$ v0.60-rc2-0-gc581932 #### $$VERSION$$ v0.60-rc2-2-g7727608

4
doc/2_usage.md
View File

@ -1,4 +1,4 @@
## Make your own Bot ## Gettting Started
All Commands for the Bot are in the ```commands.sh``` file (this should ease upgrades of the bot core). Here you find some examples how to process messages and send out text. All Commands for the Bot are in the ```commands.sh``` file (this should ease upgrades of the bot core). Here you find some examples how to process messages and send out text.
@ -154,6 +154,6 @@ Allowed values: typing for text messages, upload_photo for photos, record_video
send_action "${CHAT[ID]}" "action" send_action "${CHAT[ID]}" "action"
``` ```
#### $$VERSION$$ v0.60-rc2-0-gc581932 #### $$VERSION$$ v0.60-rc2-2-g7727608

2
doc/3_advanced.md
View File

@ -153,5 +153,5 @@ To send stickers through an *inline query*:
answer_inline_query "$iQUERY_ID" "cached_sticker" "identifier for the sticker" answer_inline_query "$iQUERY_ID" "cached_sticker" "identifier for the sticker"
``` ```
#### $$VERSION$$ v0.60-rc2-0-gc581932 #### $$VERSION$$ v0.60-rc2-2-g7727608

2
doc/4_expert.md
View File

@ -102,5 +102,5 @@ An example crontab is provided in ```bashbot.cron```.
- if you run bashbot as an other user or a system service edit ```bashbot.cron``` to fit your needs and replace username```nobody``` with the username you want to run bashbot. copy the modified file to ```/etc/cron.d/bashbot``` - if you run bashbot as an other user or a system service edit ```bashbot.cron``` to fit your needs and replace username```nobody``` with the username you want to run bashbot. copy the modified file to ```/etc/cron.d/bashbot```
#### $$VERSION$$ v0.60-rc2-0-gc581932 #### $$VERSION$$ v0.60-rc2-2-g7727608

2
doc/5_practice.md
View File

@ -112,5 +112,5 @@ In bashbot.sh line 490:
Here are two warnings in bashbots scripts. The first is a hint you may use shell substitions instead of sed, this is really possible and much faster! Here are two warnings in bashbots scripts. The first is a hint you may use shell substitions instead of sed, this is really possible and much faster!
The second warning is about an unused variable, this is true because in our examples CONTACT is not used but assigned in case you want to use it :-) The second warning is about an unused variable, this is true because in our examples CONTACT is not used but assigned in case you want to use it :-)
#### $$VERSION$$ v0.60-rc2-0-gc581932 #### $$VERSION$$ v0.60-rc2-2-g7727608

10
doc/6_reference.md
View File

@ -111,15 +111,15 @@ send_file "${CHAT[ID]}" "https://www.domain,com/something.gif" "Something"
---- ----
##### send_keyboard ##### send_keyboard
Note: since version 0.6 send_keyboard was changed to use native "JSON Array" as used from Telegram. Note: since version 0.6 send_keyboard was changed to use native "JSON Array" notation as used from Telegram. Eexample Keybord Array definitions:
*usage:* send_keyboard "chat-id" "keyboard" *usage:* send_keyboard "chat-id" "keyboard"
*example:* *example:*
```bash ```bash
send_keyboard "${CHAT[ID]}" "[ \"yes\" , \"no\" ]" send_keyboard "${CHAT[ID]}" "[ \\"yes\" , \\"no\" ]""
send_keyboard "${CHAT[ID]}" "[ \"yes\" ] , [ \"no\" ]" send_keyboard "${CHAT[ID]}" "[ \\"yes\\" ] , [ \\"no\\" ]"
send_keyboard "${CHAT[ID]}" "[ \"1\" , \"2\" , \"3\" ] , [ \"4\" , \"5\" , \"6\" ] , [ \"7\" , \"8\" , \"9\" ] , [ \"0\" ]" send_keyboard "${CHAT[ID]}" "[ \\"1\\" , \\"2\\" , \\"3\\" ] , [ \\"4\\" , \\"5\\" , \\"6\\" ] , [ \\"7\\" , \\"8\\" , \\"9\\" ] , [ \\"0\\" ]"
``` ```
##### remove_keyboard ##### remove_keyboard
@ -325,5 +325,5 @@ The name of your bot is availible as bash variable "$ME", there is no need to ca
##### inproc ##### inproc
Send Input from Telegram to waiting Interactive Chat. Send Input from Telegram to waiting Interactive Chat.
#### $$VERSION$$ v0.60-rc2-0-gc581932 #### $$VERSION$$ v0.60-rc2-2-g7727608