View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0004048 | unreal | public | 2011-11-06 11:48 | 2011-11-06 18:02 | |
| Reporter | samu | Assigned To | Stealth | ||
| Priority | normal | Severity | feature | Reproducibility | have not tried |
| Status | closed | Resolution | not fixable | ||
| Product Version | 3.2.9 | ||||
| Summary | 0004048: Join cooldown, when granting permissions | ||||
| Description | This is not a bug, but it can be used to do a little hack on somebodies channel. When the channel is empty, and an user joins, he has got OP permissions by default. After that, a service (for instance, anope chanserv) takes that permissions away. But in that short period of time it is possible to actually use that OP permissions - to change the topic, op another person, or whatever. I think it would be nice if there was a "cooldown" config option for UnrealIRCd, that would give the op permission in a specified time after the join. This would give services enough time to react correctly. | ||||
| Steps To Reproduce | Get on any network with unreal and anope, find an empty, but registered channel, or create one. Then, send the following to unreal JOIN #somechann TOPIC #somechan :somestring TOPIC #somechan :somestring PART #somechan JOIN #somechan The topic should now be marked as set by your client. | ||||
| 3rd party modules | |||||
|
|
This is how IRC works. It's called a race condition and is actually found in MANY places on IRC. If your network/services are set up properly, the following will be true: - There will not be enough time for a second user to join before the first user gets deopped. - There will not be enough time to op another user before being deopped. - If the services deops the first person, they should also deop the second person. - Services will change the topic to the proper topic after the deopping takes place. - Services will also undo any modes that may have been set on the channel. If you notice, Unreal is VERY dependent on the services package and all these are something to do with services. If you don't like this, set set::level-on-join to none. |
