View Issue Details

IDProjectCategoryView StatusLast Update
0006160unrealircdpublic2022-08-29 10:37
Reportersyzop Assigned Tosyzop  
PrioritynormalSeverityminorReproducibilityalways
Status resolvedResolutionfixed 
Product Version6.0.4 
Target Version6.0.5Fixed in Version6.0.4.1 
Summary0006160: OperOverride does not bypass +L restriction
DescriptionIn some cases you are still redirected to the channel specified in +L despite using OpverOverride.
For bans it works OK (not redirected), but for example for +l 1, it still redirects you to the specified +L channel as if you were not using OperOverride.

Figure out for which other things this is true / make sure it works for all +L cases properly. It should just not apply +L for any case where a user is invited (operoverride included).
Steps To ReproduceClient 1 (regular user):
MODE #test +L #other
MODE #test +l 1

Client 2 (ircop):
INVITE myself #test
JOIN #test

You end up in #other
TagsNo tags attached.
3rd party modules

Activities

syzop

2022-08-06 15:56

administrator   ~0022618

Fixed in https://github.com/unrealircd/unrealircd/commit/0d139c6e7c268e31ca8a4c9fc5cb7bfeb4f56831
Will be in 6.0.5 or 6.0.4.1 or whatever it will be.

commit 0d139c6e7c268e31ca8a4c9fc5cb7bfeb4f56831 (HEAD -> unreal60_dev, origin/unreal60_dev, origin/HEAD)
Author: Bram Matthys <syzop@vulnscan.org>
Date: Sat Aug 6 15:42:19 2022 +0200

    Make /INVITE bypass (nearly) all channel mode restrictions, as it used to be
    and as it should be IMO. Both for invites by channel ops and for OperOverride.
    
    This also fixes a bug where an IRCOp with OperOverride could not bypass +l
    and other restrictions. Only +b and +i could be bypassed.
    
    Module coders: HOOKTYPE_OPER_INVITE_BAN is now gone and HOOKTYPE_INVITE_BYPASS
    is now new. The HOOKTYPE_INVITE_BYPASS is called when the user is joining
    a channel to which they were invited to. If you return HOOK_DENY there then
    the join is still blocked, otherwise it is allowed.
    Using this hook would be sortof unusual since usually you would want users
    to be able to bypass restrictions when they were invited by another user
    or when they invited themselves using OperOverride.
    The only example where we use it in UnrealIRCd is for +O channels so an
    IRCOp cannot use OperOverride to join +O channels when they would otherwise
    not be allowed to do so. Actually even that is a corner case that you could
    debate about, but.. whatever.

syzop

2022-08-06 15:58

administrator   ~0022619

Last edited: 2022-08-06 15:58

The reason for this bug was indirect... in UnrealIRCd 5 the same code exists: in can_join() it first checks join restrictions from modules and then invite restriction, and then there are more hardcoded restrictions.
In UnrealIRCd 6 the hardcoded restrictions that were previously at the end of can_join() in UnrealIRCd 5 were moved to the modules... and thus ended up being processed at the beginning... before the invite check.
Now the invite check is at the very beginning with... well... see the commit in previous reply for all details.

syzop

2022-08-29 10:37

administrator   ~0022634

This is one of the two fixes that was backported to 6.0.4.1. UnrealIRCd 6.0.4.1 was released today.

Issue History

Date Modified Username Field Change
2022-08-06 15:20 syzop New Issue
2022-08-06 15:20 syzop Status new => confirmed
2022-08-06 15:56 syzop Assigned To => syzop
2022-08-06 15:56 syzop Status confirmed => resolved
2022-08-06 15:56 syzop Resolution open => fixed
2022-08-06 15:56 syzop Fixed in Version => 6.0.5
2022-08-06 15:56 syzop Note Added: 0022618
2022-08-06 15:58 syzop Note Added: 0022619
2022-08-06 15:58 syzop Note Edited: 0022619
2022-08-29 10:37 syzop Fixed in Version 6.0.5 => 6.0.4.1
2022-08-29 10:37 syzop Note Added: 0022634