The bug allowed unprivileged users to trigger use-after-free while
unloading modules
Note that the fix requires a slight API change for OnEmbeddedWebRequest:
now the callers (webadmin is the only known caller of it) call it via
DoEmbeddedWebRequest() instead. The modules which implement this hook
need no changes.
CVE-2026-82373
Found by Claude from Anthropic, reported by Ada Logics.
Fixes potential desync where ZNC marks channel as parted before server
confirms the PART, which could cause issues if the server never replies.
Add unittests and integration tests.
ZNC remembers that it should join these channels, and will join them after registration. But if client automatically joins some channels, we don't want it to be added to send queue before parts of registration itself (CAP, AUTHENTICATE), because server will just disconnect with "Registration timeout". After registration is complete, using /join still joins the channel immediately.
Only limiting this to joins, because server may request some input from user to finish registration, and joins are the ones which are prone to be sent automatically by client to cause issues.
Fix#1949
This is a way for admins to mitigate some issues caused by caps if such issues ever arise.
E.g. add this to global level in znc.conf:
DisableClientCap = sasl
DisableServerCap = chghost
DisableServerCap = message-tags
Then these caps will be NAKed to client / not requested from server.
Note that this mechanism doesn't fully prevent a cap from being activated, e.g. one could use *send_raw module to request it from server even when disabled.
Some clients will reuse query windows as the client thinks its just a
nick change if you have a existing query window with a module and a different one messages you.
Fix that by using the modules name as the ident.
Update tests to match new modules ident.
The idea here was that modules would dynamically add handlers to the
map, then it needs to be per client; but a simpler way to achieve this
will be in next commit
Used for "server-dependent" caps which already rely on sending NEW and
DEL to client. This functionality is not yet available for caps added by
modules.
Alhuda Khan