adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-10-31 01:32:02 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity
6,065 Commits 6 Branches 92 Tags
a9ec2fb9a4d924e52199e52a3a08e186cc25b94c
Commit Graph
6065 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Alhuda Khan a9ec2fb9a4 bouncedcc: connect to the bounce port via localhost in the test 
The bounce listener binds to the IRC socket's local address. With the
inttest unix sockets that is "localhost" on Linux, which Csocket
resolves to ::1, so connecting to 127.0.0.1 never reached it.
 2026-10-24 11:57:02 +05:30
Alhuda Khan d5375e58f8 bouncedcc: only let the user's own clients connect to an IRC-originated bounce 
When the DCC request came from IRC, ZNC connects out to the remote peer
and the thing connecting to the bounce listener should be one of the
user's clients. In GetSockObj, compare the connecting address with the
remote IP of each currently connected client and refuse anyone else,
closing the accepted socket straight away while leaving the listener up
for the real client. The user-originated path is unchanged, since there
it is the remote IRC peer that is expected to connect.
 2026-10-23 13:00:06 +05:30
Alhuda Khan 8aef9873fc bouncedcc: refuse DCC requests from IRC aimed at loopback or link-local 
The address in an incoming DCC CHAT/SEND is chosen by the remote IRC
user, and ZNC is the side that connects to it, relaying traffic to
whoever connects to the bounce listener. Refuse requests that point at
0/8, 127/8, 169.254/16, 224/3 or values above 32 bits (which
CUtils::GetIP would otherwise mask down to one of those).
 2026-10-20 17:36:19 +05:30
Alexey Sokolov 3d96465fc0 Merge pull request #2054 from kitkatt7/zncstring-randomstring-csprng 
zncstring: generate RandomString with a CSPRNG instead of rand()
 2026-10-19 18:55:42 +01:00
Alhuda Khan 71dd0e0f88 zncstring: use openssl RAND_bytes for RandomString when available 2026-10-18 12:22:56 +05:30
Alexey Sokolov 881de2f4d5 Merge pull request #2053 from kitkatt7/formattime-usec-pad-underflow 
utils: fix size_t underflow in FormatTime %f padding
 2026-10-18 00:53:43 +01:00
Alexey Sokolov 971506c13f Merge pull request #2052 from kitkatt7/unsigned-char-ctype 
cast to unsigned char for ctype calls on signed-char input
 2026-10-18 00:49:33 +01:00
Alexey Sokolov 1a648ec276 Merge pull request #2050 from RealKindOne/ice-theme 
Fix broken unix socket table in webadmin with 'ice' theme.
 2026-10-18 00:25:55 +01:00
RealKindOne 9c0e8662d3 Use '3em' instead of '40px' for 'ice' theme 2026-10-14 21:18:51 -04:00
Alhuda Khan 5916955b80 zncstring: generate RandomString with a CSPRNG instead of rand() 2026-10-14 15:10:53 +05:30
Alhuda Khan 16908dc4aa utils: fix size_t underflow in FormatTime %f padding 2026-10-14 11:32:00 +05:30
Alhuda Khan 942e458bf5 cast to unsigned char for ctype calls on signed-char input 2026-10-11 23:54:28 +05:30
RealKindOne 255bccea97 Fix broken unix socket table in webadmin with 'ice' theme. 
Fixes #1975
 2026-10-05 01:09:21 -04:00
Alexey Sokolov f651a6f34f Merge pull request #2048 from RealKindOne/remove-PutAllUser 
Remove deprecated PutAllUser().

It was deprecated in 1.9.0
 2026-10-02 07:27:17 +01:00
RealKindOne fcc0ef8a72 Remove deprecated PutAllUser(). 
Removes multiple -Wdeprecated-declarations warnings for modperl/modpython.
 2026-10-02 01:27:44 -04:00
Alexey Sokolov 3f67acfc4b Merge pull request #2047 from RealKindOne/fix-listsockets 
listsockets: Fix 1970s date bug.
 2026-10-02 01:43:31 +01:00
RealKindOne f5c865015c listsockets: Add TODO comment and update test. 2026-10-01 20:00:11 -04:00
RealKindOne bc25a36972 listsockets: Fix 1970s date bug. 
Fixes #1910
 2026-10-01 15:26:10 -04:00
Alexey Sokolov 1158f3bf58 Merge pull request #2046 from znc/dependabot/github_actions/github/codeql-action-4.38.2 
build(deps): bump github/codeql-action from 4.37.3 to 4.38.2
 2026-10-01 19:47:29 +01:00
dependabot[bot] 10f78dc22c build(deps): bump github/codeql-action from 4.37.3 to 4.38.2 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.37.3 to 4.38.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/v4.37.3...v4.38.2)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.38.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-01 12:36:12 +00:00
Alexey Sokolov 4a19b6ffb1 Merge pull request #2042 from RealKindOne/bugfixes 
Stop znc from prepending '#' in join command if missing and fix corecaps wiki link.
 2026-09-22 01:12:03 +01:00
RealKindOne d6c2c32de8 Stop ZNC from prepending '#' if missing in join command. 
Fixes #1794
 2026-09-13 14:20:36 -04:00
RealKindOne 18f304e6a4 corecaps: Add missing wiki info. 2026-09-13 14:19:50 -04:00
Alexey Sokolov 9c9ad77afa update freebsd readme badge url 2026-09-13 13:46:48 +01:00
RealKindOne 30d14d0841 Improve test coverage for clearbufferonmsg, crypt, ctcpflood, and watch. 
Close #2038
 2026-09-13 11:27:54 +01:00
RealKindOne cdf29c0dd4 awaystore: Fix NoSSL and GCC ASin build 2026-09-13 11:27:31 +01:00
RealKindOne ff65bc01fb awaystore: Modernize and add test. Fixed various bugs. 
Fixed 'pass' command to save password in CBlowfish(MD5(...)) instead of plaintext.

Fixed 'away' command not updating with a new away message if already away.

Fixed default timer in SetArgsHelpText to match SetAwayTime().

Fixed broken 'Messages' command.

Fixed 'replay' command with IPv6

Fixes #815
 2026-09-13 11:27:31 +01:00
RealKindOne 375e744298 autoattach: use const CString& in TryAttach and simplify On...Message events. 
TryAttach() only reads and never mutates.
 2026-09-13 11:27:31 +01:00
RealKindOne 0b860b23bf Fix chansaver test. 2026-09-13 11:27:31 +01:00
RealKindOne 97e3932f03 Fix autoreply, chansaver, and stickychan test. 2026-09-13 11:27:31 +01:00
RealKindOne e7d188c3ec watch: Modernize and update test. 2026-09-13 11:27:31 +01:00
RealKindOne bbfec24e6b stichychan: Modernize and add test. 2026-09-13 11:27:31 +01:00
RealKindOne ecaf056d47 nickserv: Modernize and add test. 2026-09-13 11:27:31 +01:00
RealKindOne 9dbf062d87 kickrejoin: Modernize and add test. 2026-09-13 11:27:31 +01:00
RealKindOne ec49f11be6 keepnick: Modernize and update test. 2026-09-13 11:27:31 +01:00
RealKindOne cec9741003 flooddetach: Modernize and add test. 2026-09-13 11:27:31 +01:00
RealKindOne ca24ae726c ctcpflood: Modernize and add test. 2026-09-13 11:27:31 +01:00
RealKindOne 2a2b6068e8 clearbufferonmsg: Modernize and add test. 2026-09-13 11:27:31 +01:00
RealKindOne 28b9d8cbfb chansaver: Modernize and add test. 2026-09-13 11:27:31 +01:00
RealKindOne 97b1e8ab79 bouncedcc: Modernize and add test. 2026-09-13 11:27:31 +01:00
RealKindOne 0832094976 autoreply: Modernize and add test. 2026-09-13 11:27:31 +01:00
RealKindOne a75612dd15 autoattach: Modernize and update test. 2026-09-13 11:27:31 +01:00
Alexey Sokolov 76cdad9e6a Merge branch '1.10.x' 2026-09-13 10:54:57 +01:00
Alexey Sokolov 2fb9746406 Return version number to 1.10.x 2026-09-13 09:10:25 +01:00
Alexey Sokolov 6bd91573ce Increase the version number to 1.10.3 znc-1.10.3 2026-09-13 09:05:34 +01:00
RealKindOne af5cdd0192 crypt: Modernize and add test. Fix OnNumericMessage 332 issue. 
It was possible to trigger null pointer dereference during
OnNumericMessage

The affected versions are 1.7.0+

CVE-2026-82374
 2026-09-12 19:08:21 +01:00
Alexey Sokolov 4b88c64c6e Fix crash while unloading modules 
The bug allowed unprivileged users to trigger use-after-free while
unloading modules

Note that the fix requires a slight API change for OnEmbeddedWebRequest:
now the callers (webadmin is the only known caller of it) call it via
DoEmbeddedWebRequest() instead. The modules which implement this hook
need no changes.

CVE-2026-82373

Found by Claude from Anthropic, reported by Ada Logics.
 2026-09-12 19:08:21 +01:00
Alexey Sokolov b7cc2151ff Merge branch '1.10.x' 2026-09-06 09:49:10 +01:00
Alexey Sokolov d9b392afd9 Update jQuery to 3.5.1 
Fix #2040
CVE-2020-11022, CVE-2020-11023
 2026-09-06 09:45:58 +01:00
Alexey Sokolov fe8d43f828 Merge pull request #2037 from RealKindOne/fixtest 
Fix MotdBufferDoesNotAccumulate376 test.
 2026-08-21 20:32:25 +01:00