relay: add extra forbidden commands in weechat protocol (issue #928)

Commands were already forbidden (option relay.weechat.commands):

- /exec
- /upgrade
- /quit

These extra commands are now forbidden by default:

- /fset
- /set
- /unset
- /plugin
- /script
- /python
- /perl
- /ruby
- /lua
- /tcl
- /guile
- /javascript
- /php
- /secure

13 files changed, 57 insertions, 56 deletions

diff --git a/po/cs.po b/po/cs.po
index 7a98b1528..26a5aaeb8 100644
--- a/po/cs.po
+++ b/po/cs.po
@@ -21,7 +21,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2019-02-28 20:53+0100\n"
+"POT-Creation-Date: 2019-03-09 17:49+0100\n"
 "PO-Revision-Date: 2019-02-28 20:53+0100\n"
 "Last-Translator: Ondřej Súkup <mimi.vx@gmail.com>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@@ -10868,9 +10868,9 @@ msgid ""
 "comma-separated list of commands allowed/denied when input data (text or "
 "command) is received from a client; \"*\" means any command, a name "
 "beginning with \"!\" is a negative value to prevent a command from being "
-"executed, wildcard \"*\" is allowed in names; by default all commands are "
-"allowed except /exec, /upgrade and /quit (which could lead to denial of "
-"service or remote code execution if the client is not trusted)"
+"executed, wildcard \"*\" is allowed in names; by default some commands are "
+"not allowed (they could lead to denial of service or remote code execution "
+"if the client is not trusted)"
 msgstr ""
 
 #, fuzzy
diff --git a/po/de.po b/po/de.po
index 61eb2f143..0d90f6c99 100644
--- a/po/de.po
+++ b/po/de.po
@@ -24,7 +24,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2019-02-28 20:53+0100\n"
+"POT-Creation-Date: 2019-03-09 17:49+0100\n"
 "PO-Revision-Date: 2019-02-28 21:25+0100\n"
 "Last-Translator: Nils Görs <weechatter@arcor.de>\n"
 "Language-Team: German <kde-i18n-de@kde.org>\n"
@@ -12768,13 +12768,14 @@ msgstr ""
 "gesendet wird); keine Zeichenkette = deaktiviert die Zeitanzeige im "
 "Verlaufsspeicher"
 
+#, fuzzy
 msgid ""
 "comma-separated list of commands allowed/denied when input data (text or "
 "command) is received from a client; \"*\" means any command, a name "
 "beginning with \"!\" is a negative value to prevent a command from being "
-"executed, wildcard \"*\" is allowed in names; by default all commands are "
-"allowed except /exec, /upgrade and /quit (which could lead to denial of "
-"service or remote code execution if the client is not trusted)"
+"executed, wildcard \"*\" is allowed in names; by default some commands are "
+"not allowed (they could lead to denial of service or remote code execution "
+"if the client is not trusted)"
 msgstr ""
 "durch Kommata getrennte Liste von Befehlen die erlaubt/verboten sind wenn "
 "Daten (Text oder Befehl) vom Client empfangen werden; \"*\" bedeutet alle "
diff --git a/po/es.po b/po/es.po
index 42b8e1a6a..248f35eb9 100644
--- a/po/es.po
+++ b/po/es.po
@@ -22,7 +22,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2019-02-28 20:53+0100\n"
+"POT-Creation-Date: 2019-03-09 17:49+0100\n"
 "PO-Revision-Date: 2019-02-28 20:53+0100\n"
 "Last-Translator: Elián Hanisch <lambdae2@gmail.com>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@@ -11221,9 +11221,9 @@ msgid ""
 "comma-separated list of commands allowed/denied when input data (text or "
 "command) is received from a client; \"*\" means any command, a name "
 "beginning with \"!\" is a negative value to prevent a command from being "
-"executed, wildcard \"*\" is allowed in names; by default all commands are "
-"allowed except /exec, /upgrade and /quit (which could lead to denial of "
-"service or remote code execution if the client is not trusted)"
+"executed, wildcard \"*\" is allowed in names; by default some commands are "
+"not allowed (they could lead to denial of service or remote code execution "
+"if the client is not trusted)"
 msgstr ""
 
 #, fuzzy
diff --git a/po/fr.po b/po/fr.po
index 4883a7463..8d9f950cc 100644
--- a/po/fr.po
+++ b/po/fr.po
@@ -21,8 +21,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2019-02-28 20:53+0100\n"
-"PO-Revision-Date: 2019-02-28 20:53+0100\n"
+"POT-Creation-Date: 2019-03-09 17:49+0100\n"
+"PO-Revision-Date: 2019-03-09 17:51+0100\n"
 "Last-Translator: Sébastien Helleu <flashcode@flashtux.org>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
 "Language: fr\n"
@@ -12495,17 +12495,17 @@ msgid ""
 "comma-separated list of commands allowed/denied when input data (text or "
 "command) is received from a client; \"*\" means any command, a name "
 "beginning with \"!\" is a negative value to prevent a command from being "
-"executed, wildcard \"*\" is allowed in names; by default all commands are "
-"allowed except /exec, /upgrade and /quit (which could lead to denial of "
-"service or remote code execution if the client is not trusted)"
+"executed, wildcard \"*\" is allowed in names; by default some commands are "
+"not allowed (they could lead to denial of service or remote code execution "
+"if the client is not trusted)"
 msgstr ""
 "liste des commandes autorisées/interdites lorsque qu'une entrée de données "
 "(texte ou commande) est reçue du client (séparées par des virgules) ; \"*\" "
 "signifie toutes les commandes, un nom commençant par \"!\" est une valeur "
 "négative pour empêcher une commande d'être exécutée, le caractère joker \"*"
-"\" est autorisé dans les noms ; par défaut toutes les commandes sont "
-"autorisées sauf /exec, /upgrade et /quit (ce qui pourrait conduire à un déni "
-"de service ou l'exécution de commandes à distance si le client n'est pas sûr)"
+"\" est autorisé dans les noms ; par défaut certaines commandes ne sont pas "
+"autorisées (elles pourraient conduire à un déni de service ou l'exécution de "
+"commandes à distance si le client n'est pas sûr)"
 
 msgid "number of clients for relay"
 msgstr "nombre de clients pour le relai"
diff --git a/po/hu.po b/po/hu.po
index 5b81d50fc..5af9ff860 100644
--- a/po/hu.po
+++ b/po/hu.po
@@ -20,7 +20,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2019-02-28 20:53+0100\n"
+"POT-Creation-Date: 2019-03-09 17:49+0100\n"
 "PO-Revision-Date: 2019-02-28 20:18+0100\n"
 "Last-Translator: Andras Voroskoi <voroskoi@frugalware.org>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@@ -10227,9 +10227,9 @@ msgid ""
 "comma-separated list of commands allowed/denied when input data (text or "
 "command) is received from a client; \"*\" means any command, a name "
 "beginning with \"!\" is a negative value to prevent a command from being "
-"executed, wildcard \"*\" is allowed in names; by default all commands are "
-"allowed except /exec, /upgrade and /quit (which could lead to denial of "
-"service or remote code execution if the client is not trusted)"
+"executed, wildcard \"*\" is allowed in names; by default some commands are "
+"not allowed (they could lead to denial of service or remote code execution "
+"if the client is not trusted)"
 msgstr ""
 
 #, fuzzy
diff --git a/po/it.po b/po/it.po
index 256d9a5e3..cb42ff357 100644
--- a/po/it.po
+++ b/po/it.po
@@ -20,7 +20,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2019-02-28 20:53+0100\n"
+"POT-Creation-Date: 2019-03-09 17:49+0100\n"
 "PO-Revision-Date: 2019-02-28 20:53+0100\n"
 "Last-Translator: Esteban I. Ruiz Moreno <exio4.com@gmail.com>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@@ -11423,9 +11423,9 @@ msgid ""
 "comma-separated list of commands allowed/denied when input data (text or "
 "command) is received from a client; \"*\" means any command, a name "
 "beginning with \"!\" is a negative value to prevent a command from being "
-"executed, wildcard \"*\" is allowed in names; by default all commands are "
-"allowed except /exec, /upgrade and /quit (which could lead to denial of "
-"service or remote code execution if the client is not trusted)"
+"executed, wildcard \"*\" is allowed in names; by default some commands are "
+"not allowed (they could lead to denial of service or remote code execution "
+"if the client is not trusted)"
 msgstr ""
 
 #, fuzzy
diff --git a/po/ja.po b/po/ja.po
index ad4531729..08349c77d 100644
--- a/po/ja.po
+++ b/po/ja.po
@@ -20,7 +20,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2019-02-28 20:53+0100\n"
+"POT-Creation-Date: 2019-03-09 17:49+0100\n"
 "PO-Revision-Date: 2019-02-28 20:53+0100\n"
 "Last-Translator: AYANOKOUZI, Ryuunosuke <i38w7i3@yahoo.co.jp>\n"
 "Language-Team: Japanese <https://github.com/l/weechat/tree/master/"
@@ -12043,9 +12043,9 @@ msgid ""
 "comma-separated list of commands allowed/denied when input data (text or "
 "command) is received from a client; \"*\" means any command, a name "
 "beginning with \"!\" is a negative value to prevent a command from being "
-"executed, wildcard \"*\" is allowed in names; by default all commands are "
-"allowed except /exec, /upgrade and /quit (which could lead to denial of "
-"service or remote code execution if the client is not trusted)"
+"executed, wildcard \"*\" is allowed in names; by default some commands are "
+"not allowed (they could lead to denial of service or remote code execution "
+"if the client is not trusted)"
 msgstr ""
 
 msgid "number of clients for relay"
diff --git a/po/pl.po b/po/pl.po
index c12d1eb49..cabb0062d 100644
--- a/po/pl.po
+++ b/po/pl.po
@@ -22,7 +22,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2019-02-28 20:53+0100\n"
+"POT-Creation-Date: 2019-03-09 17:49+0100\n"
 "PO-Revision-Date: 2019-02-28 20:53+0100\n"
 "Last-Translator: Krzysztof Korościk <soltys@soltys.info>\n"
 "Language-Team: Polish <kde-i18n-doc@kde.org>\n"
@@ -12227,9 +12227,9 @@ msgid ""
 "comma-separated list of commands allowed/denied when input data (text or "
 "command) is received from a client; \"*\" means any command, a name "
 "beginning with \"!\" is a negative value to prevent a command from being "
-"executed, wildcard \"*\" is allowed in names; by default all commands are "
-"allowed except /exec, /upgrade and /quit (which could lead to denial of "
-"service or remote code execution if the client is not trusted)"
+"executed, wildcard \"*\" is allowed in names; by default some commands are "
+"not allowed (they could lead to denial of service or remote code execution "
+"if the client is not trusted)"
 msgstr ""
 
 msgid "number of clients for relay"
diff --git a/po/pt.po b/po/pt.po
index a8395195c..e9367b9d6 100644
--- a/po/pt.po
+++ b/po/pt.po
@@ -20,7 +20,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2019-02-28 20:53+0100\n"
+"POT-Creation-Date: 2019-03-09 17:49+0100\n"
 "PO-Revision-Date: 2019-02-28 20:53+0100\n"
 "Last-Translator: Vasco Almeida <vascomalmeida@sapo.pt>\n"
 "Language-Team: Portuguese <>\n"
@@ -11883,9 +11883,9 @@ msgid ""
 "comma-separated list of commands allowed/denied when input data (text or "
 "command) is received from a client; \"*\" means any command, a name "
 "beginning with \"!\" is a negative value to prevent a command from being "
-"executed, wildcard \"*\" is allowed in names; by default all commands are "
-"allowed except /exec, /upgrade and /quit (which could lead to denial of "
-"service or remote code execution if the client is not trusted)"
+"executed, wildcard \"*\" is allowed in names; by default some commands are "
+"not allowed (they could lead to denial of service or remote code execution "
+"if the client is not trusted)"
 msgstr ""
 
 msgid "number of clients for relay"
diff --git a/po/pt_BR.po b/po/pt_BR.po
index df7c74b70..df891778e 100644
--- a/po/pt_BR.po
+++ b/po/pt_BR.po
@@ -21,7 +21,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2019-02-28 20:53+0100\n"
+"POT-Creation-Date: 2019-03-09 17:49+0100\n"
 "PO-Revision-Date: 2019-02-28 20:53+0100\n"
 "Last-Translator: Eduardo Elias <camponez@gmail.com>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@@ -10676,9 +10676,9 @@ msgid ""
 "comma-separated list of commands allowed/denied when input data (text or "
 "command) is received from a client; \"*\" means any command, a name "
 "beginning with \"!\" is a negative value to prevent a command from being "
-"executed, wildcard \"*\" is allowed in names; by default all commands are "
-"allowed except /exec, /upgrade and /quit (which could lead to denial of "
-"service or remote code execution if the client is not trusted)"
+"executed, wildcard \"*\" is allowed in names; by default some commands are "
+"not allowed (they could lead to denial of service or remote code execution "
+"if the client is not trusted)"
 msgstr ""
 
 #, fuzzy
diff --git a/po/ru.po b/po/ru.po
index e7e1e8f42..da486c06c 100644
--- a/po/ru.po
+++ b/po/ru.po
@@ -21,7 +21,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2019-02-28 20:53+0100\n"
+"POT-Creation-Date: 2019-03-09 17:49+0100\n"
 "PO-Revision-Date: 2019-02-28 20:19+0100\n"
 "Last-Translator: Aleksey V Zapparov AKA ixti <ixti@member.fsf.org>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@@ -10260,9 +10260,9 @@ msgid ""
 "comma-separated list of commands allowed/denied when input data (text or "
 "command) is received from a client; \"*\" means any command, a name "
 "beginning with \"!\" is a negative value to prevent a command from being "
-"executed, wildcard \"*\" is allowed in names; by default all commands are "
-"allowed except /exec, /upgrade and /quit (which could lead to denial of "
-"service or remote code execution if the client is not trusted)"
+"executed, wildcard \"*\" is allowed in names; by default some commands are "
+"not allowed (they could lead to denial of service or remote code execution "
+"if the client is not trusted)"
 msgstr ""
 
 #, fuzzy
diff --git a/po/tr.po b/po/tr.po
index 1c1b7f198..8406684e1 100644
--- a/po/tr.po
+++ b/po/tr.po
@@ -20,7 +20,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2019-02-28 20:53+0100\n"
+"POT-Creation-Date: 2019-03-09 17:49+0100\n"
 "PO-Revision-Date: 2019-01-29 21:05+0100\n"
 "Last-Translator: Hasan Kiran <sunder67@hotmail.com>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@@ -9322,9 +9322,9 @@ msgid ""
 "comma-separated list of commands allowed/denied when input data (text or "
 "command) is received from a client; \"*\" means any command, a name "
 "beginning with \"!\" is a negative value to prevent a command from being "
-"executed, wildcard \"*\" is allowed in names; by default all commands are "
-"allowed except /exec, /upgrade and /quit (which could lead to denial of "
-"service or remote code execution if the client is not trusted)"
+"executed, wildcard \"*\" is allowed in names; by default some commands are "
+"not allowed (they could lead to denial of service or remote code execution "
+"if the client is not trusted)"
 msgstr ""
 
 msgid "number of clients for relay"
diff --git a/po/weechat.pot b/po/weechat.pot
index e97398512..8f26318b6 100644
--- a/po/weechat.pot
+++ b/po/weechat.pot
@@ -21,7 +21,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WeeChat\n"
 "Report-Msgid-Bugs-To: flashcode@flashtux.org\n"
-"POT-Creation-Date: 2019-02-28 20:53+0100\n"
+"POT-Creation-Date: 2019-03-09 17:49+0100\n"
 "PO-Revision-Date: 2014-08-16 10:27+0200\n"
 "Last-Translator: Sébastien Helleu <flashcode@flashtux.org>\n"
 "Language-Team: weechat-dev <weechat-dev@nongnu.org>\n"
@@ -9189,9 +9189,9 @@ msgid ""
 "comma-separated list of commands allowed/denied when input data (text or "
 "command) is received from a client; \"*\" means any command, a name "
 "beginning with \"!\" is a negative value to prevent a command from being "
-"executed, wildcard \"*\" is allowed in names; by default all commands are "
-"allowed except /exec, /upgrade and /quit (which could lead to denial of "
-"service or remote code execution if the client is not trusted)"
+"executed, wildcard \"*\" is allowed in names; by default some commands are "
+"not allowed (they could lead to denial of service or remote code execution "
+"if the client is not trusted)"
 msgstr ""
 
 msgid "number of clients for relay"