The bounce listener binds to the IRC socket's local address. With the
inttest unix sockets that is "localhost" on Linux, which Csocket
resolves to ::1, so connecting to 127.0.0.1 never reached it.
The Allow list was only checked in CZNC::AuthUser() after the core
password check, so logins accepted by imapauth, cyrusauth or certauth
(including SASL EXTERNAL) ignored it. Check it in CAuthBase::AcceptLogin()
and CClient::AcceptSASLLogin() instead.
When the DCC request came from IRC, ZNC connects out to the remote peer
and the thing connecting to the bounce listener should be one of the
user's clients. In GetSockObj, compare the connecting address with the
remote IP of each currently connected client and refuse anyone else,
closing the accepted socket straight away while leaving the listener up
for the real client. The user-originated path is unchanged, since there
it is the remote IRC peer that is expected to connect.
The address in an incoming DCC CHAT/SEND is chosen by the remote IRC
user, and ZNC is the side that connects to it, relaying traffic to
whoever connects to the bounce listener. Refuse requests that point at
0/8, 127/8, 169.254/16, 224/3 or values above 32 bits (which
CUtils::GetIP would otherwise mask down to one of those).
Fixed 'pass' command to save password in CBlowfish(MD5(...)) instead of plaintext.
Fixed 'away' command not updating with a new away message if already away.
Fixed default timer in SetArgsHelpText to match SetAwayTime().
Fixed broken 'Messages' command.
Fixed 'replay' command with IPv6
Fixes#815
Added m_bMotdBegun flag to track MOTD state. MOTD lines (372, 376) are now only
buffered if MOTD has begun (375/422), and 376 itself is not buffered.
The flag is reset on 263 rate limit responses to prevent repeat 376 messages.
Fixes#1460
Fixes potential desync where ZNC marks channel as parted before server
confirms the PART, which could cause issues if the server never replies.
Add unittests and integration tests.
Alhuda Khan