When the DCC request came from IRC, ZNC connects out to the remote peer
and the thing connecting to the bounce listener should be one of the
user's clients. In GetSockObj, compare the connecting address with the
remote IP of each currently connected client and refuse anyone else,
closing the accepted socket straight away while leaving the listener up
for the real client. The user-originated path is unchanged, since there
it is the remote IRC peer that is expected to connect.
The address in an incoming DCC CHAT/SEND is chosen by the remote IRC
user, and ZNC is the side that connects to it, relaying traffic to
whoever connects to the bounce listener. Refuse requests that point at
0/8, 127/8, 169.254/16, 224/3 or values above 32 bits (which
CUtils::GetIP would otherwise mask down to one of those).
Fixed 'pass' command to save password in CBlowfish(MD5(...)) instead of plaintext.
Fixed 'away' command not updating with a new away message if already away.
Fixed default timer in SetArgsHelpText to match SetAwayTime().
Fixed broken 'Messages' command.
Fixed 'replay' command with IPv6
Fixes#815
The bug allowed unprivileged users to trigger use-after-free while
unloading modules
Note that the fix requires a slight API change for OnEmbeddedWebRequest:
now the callers (webadmin is the only known caller of it) call it via
DoEmbeddedWebRequest() instead. The modules which implement this hook
need no changes.
CVE-2026-82373
Found by Claude from Anthropic, reported by Ada Logics.
Read() returned up to 1024 bytes into a stack buffer that was then
assigned to a CString via the const char* overload, so strlen() walked
past the end of buf when the file filled all 1024 bytes without a NUL.
ReadFile() bounds the append by the byte count Read() returns and reads
the whole file, so the original contents also round-trip faithfully.
SWIG 4.4 has dropped the usage of SWIG_NULLPTR again, which means we can't
rely on its presence to identify SWIG >= 4.2.0
Generate a swig_version.h by parsing the output of `swig -version` and
writing this in a hex representation
Fixes#1979
Use of newAV_alloc_x() was added in a7dffb8f (Add modperl support for
sasl, 2025-03-16), but it has the unintended consequence of increasing
the minimum Perl version a bit more than desired. Replace it with the
roughly equivalent code as documented in perlapi(1), which can be read
online at <https://perldoc.perl.org/perlapi#newAV>.
Fix#1966
Alhuda Khan