View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0006619unrealircdpublic2026-04-07 06:312026-04-07 18:15
Reporterravertine Assigned Tosyzop  
PrioritylowSeverityminorReproducibilityalways
Status resolvedResolutionfixed 
Product Version6.2.4-rc1 
Summary0006619: I think the operclass permissions "channel:override:secureonly " doesn't work
DescriptionIt seems I'm unable to join channels +z when I'm not connected through SSL.

Here is the relevant part of my unrealircd.conf

oper test {
    class opers;
    mask {
        *@192.168.*;
        *@127.0.0.1;
        *@localhost;
        }
    password **REDACTED**;
    operclass netadmin-with-override;
}

From my understanding of the doc available at https://www.unrealircd.org/docs/Operclass_permissions#channel
I should be able to join a channel +z even if i'm not connected via a secure connection.

yet...

/mode #test
#test +ntzPZ
#test created on Mon Apr 06 23:47:28 2026

/join #test
#test unable to join channel (not using secure connection)

even if I modify unrealircd.conf file to explicitly gave myself channel:override:secureonly, it still doesn't work

operclass oper-test {
       parent netadmin-with-override;
       permissions {
                channel {
            override {
                secureonly;
            }
        }
       }
}

oper test {
    class opers;
    mask {
        *@192.168.*;
        *@127.0.0.1;
        *@localhost;
        }
    password **REDACTED**;
    operclass oper-test;
}

/sajoin myself #test also doesn't work.

I had this issue with 6.2.1 on Windows but the bug is still present with 6.2.4-rc1 on Debian.
3rd party modules

Activities

syzop

2026-04-07 07:23

administrator   ~0023635

I think these go through the https://www.unrealircd.org/docs/OperOverride mechanism nowadays. So you would have to INVITE yourself first.

The docs under https://www.unrealircd.org/docs/Operclass_permissions#channel could be more clear/explicit about this. Will look at it when i'm back from work.

ravertine

2026-04-07 08:31

reporter   ~0023636

Inviting myself into the channel worked... I should have tried it first...

I'm a bit curious about the SAJOIN command. I've tested it and it can bypass channel modes +i, +b, +k, +l, +R and even +O. Why doesn't it also override +z ?

According the the doc:
"Both the INVITE+JOIN and SAJOIN allow you to bypass all channel modes and all bans."

https://www.unrealircd.org/docs/IRCOp_guide#Joining_a_channel_even_if_you_normally_cannot

I understand users (specially ircops) should connect from a secure connection, but I guess I'm part of the very exception where the server and client are on the same computer.

syzop

2026-04-07 18:06

administrator   ~0023637

I think it is because people reported SAJOIN joining users through +z as a bug and we fixed it. Something like that. I can understand both views. I don't plan to change it though. I think more people should be on SSL/TLS, not less ;D.

I'll fix the documentation issue tho.

syzop

2026-04-07 18:15

administrator   ~0023638

Alright, docs updated :)

Both https://www.unrealircd.org/docs/Operclass_permissions#channel and https://www.unrealircd.org/docs/IRCOp_guide#Joining_a_channel_even_if_you_normally_cannot
Actually tempting to remove SAJOIN there at all.

Issue History

Date Modified Username Field Change
2026-04-07 06:31 ravertine New Issue
2026-04-07 07:23 syzop Note Added: 0023635
2026-04-07 08:31 ravertine Note Added: 0023636
2026-04-07 18:06 syzop Note Added: 0023637
2026-04-07 18:15 syzop Assigned To => syzop
2026-04-07 18:15 syzop Status new => resolved
2026-04-07 18:15 syzop Resolution open => fixed
2026-04-07 18:15 syzop Note Added: 0023638