The bug allowed unprivileged users to trigger use-after-free while
unloading modules
Note that the fix requires a slight API change for OnEmbeddedWebRequest:
now the callers (webadmin is the only known caller of it) call it via
DoEmbeddedWebRequest() instead. The modules which implement this hook
need no changes.
CVE-2026-82373
Found by Claude from Anthropic, reported by Ada Logics.
SWIG 4.4 has dropped the usage of SWIG_NULLPTR again, which means we can't
rely on its presence to identify SWIG >= 4.2.0
Generate a swig_version.h by parsing the output of `swig -version` and
writing this in a hex representation
Fixes#1979
Used for "server-dependent" caps which already rely on sending NEW and
DEL to client. This functionality is not yet available for caps added by
modules.
Currently, there is no usable wrapper for CModCommand for use within
bindings, so this commit adds a proxy class that adds itself as a
callback and allows implementing Python classes to implement commands
via __call__().
A completely synthetic example:
import znc
class foo(znc.Module):
module_types = [znc.CModInfo.UserModule]
def OnLoad(self, args, message):
self.AddHelpCommand()
self.AddCommand(FooCmd)
return True
class FooCmd(znc.Command):
cmd = 'foo'
args = foo.t_d('bar')
desc = foo.t_d('baz')
def __call__(self, line):
self.GetModule().PutModule('I have been foo’d!')
Fixes https://github.com/znc/znc/issues/198
'imp' was deprecated since python 3.3.
This removes the undocumented feature of loading python C extension as
ZNC module, but adds a test that python package can be loaded.
Bump python requirements to 3.4
The list of functions which returned list of unknown objects instead of
list of strings:
* CMessage::GetParams()
* CZNC::GetMotd()
* CZNC::GetTrustedProxies()
* CZNC::GetBindHosts()
The issue was triggered by CCoreTranslationMixin being parent of
CZNCSock, and DisableReadLine wasn't found as attribute anymore.
Thanks to obiw4n for report.
Alexey Sokolov