e0c573c053
Update translations from Crowdin for bg_BG da_DK de_DE el_GR es_ES fr_FR id_ID it_IT nl_NL pl_PL pt_BR pt_PT ro_RO ru_RU tr_TR
2026-05-01 00:28:00 +00:00
6186f611b9
Merge pull request #2017 from MarkLee131/fix/checkpass-constant-time
...
User: use constant-time compare for MD5/SHA256/plain password paths
2026-04-30 08:23:07 +01:00
c9d0677e4f
Utils: prefer CRYPTO_memcmp in ConstantTimeEquals when OpenSSL is available
...
Per review feedback on #2017 : a hand-rolled byte loop can in principle
be folded back into a short-circuiting compare by an aggressive optimizer.
Use CRYPTO_memcmp under HAVE_LIBSSL since OpenSSL is already a build
dependency for the SHA256 path. For non-OpenSSL builds, mark the
accumulator and pointers volatile and note in a comment that this is
best-effort.
2026-04-29 17:06:49 +08:00
866303eef0
Merge pull request #2014 from MarkLee131/fix/parseservertime-clamp-range
...
Utils: reject out-of-range years in ParseServerTime
2026-04-27 01:43:24 +01:00
7456cbaf02
Merge pull request #2016 from MarkLee131/fix/addheader-crlf-guard
...
HTTPSock: reject CR/LF in AddHeader name/value
2026-04-27 01:38:00 +01:00
8f5425f99c
Merge pull request #1999 from znc/dependabot/github_actions/codecov/codecov-action-6
...
Bump codecov/codecov-action from 5 to 6
2026-04-25 11:46:08 +01:00
2a1844ee4e
Merge pull request #2000 from znc/dependabot/github_actions/docker/login-action-4
...
Bump docker/login-action from 3 to 4
2026-04-25 11:45:34 +01:00
939d2b6c30
Merge pull request #1998 from znc/dependabot/github_actions/docker/metadata-action-6
...
Bump docker/metadata-action from 5 to 6
2026-04-25 11:45:05 +01:00
7540979707
Merge pull request #1997 from znc/dependabot/github_actions/docker/build-push-action-7
...
Bump docker/build-push-action from 6 to 7
2026-04-25 11:44:40 +01:00
0f1c646e5e
Merge pull request #1991 from znc/dependabot/github_actions/actions/upload-artifact-7
...
Bump actions/upload-artifact from 6 to 7
2026-04-25 11:44:23 +01:00
20e8f73b03
HTTPSock: extract IsValidHeaderField helper and add tests ( #2010 )
2026-04-25 17:38:31 +08:00
f0c3341e35
User,Utils: move ConstantTimeEquals to CUtils and add tests ( #2011 )
2026-04-25 17:37:33 +08:00
7c47afa888
test: cover ParseServerTime out-of-range year rejection ( #2008 )
2026-04-25 17:34:58 +08:00
794ae6cd60
User: use constant-time compare for MD5/SHA256/plain password paths
...
CString::Equals falls through to strcmp, which short-circuits on the first
differing byte. That leaks the length of the common prefix between the
stored hash (or plain password) and the attacker's guess via response
timing. Argon2id already uses argon2id_verify which is constant-time.
Add a small ConstantTimeEquals helper and use it for the legacy MD5,
SHA256 and plain HASH_NONE branches. No new dependency: the helper is
~10 lines and works on builds without OpenSSL.
2026-04-25 10:39:13 +08:00
04cf89beec
HTTPSock: reject CR/LF in AddHeader name/value
...
AddHeader wrote its arguments straight into the response stream. No
in-tree caller reaches it with attacker-controlled bytes today, but the
public API is exposed to module authors; one bad caller would be a
header-injection bug. Filter at the entry rather than at every caller.
2026-04-25 10:38:31 +08:00
b944299167
Utils: reject out-of-range years in ParseServerTime
...
cctz::parse into a microseconds time_point internally multiplies the
parsed seconds-since-epoch by 1,000,000 in signed int64. Years past ~292k
overflow, which is UB under UBSan or -ftrapv builds. In plain production
builds the overflow silently wraps and buffer playback shows a garbage
timestamp.
Reject anything with a year longer than 5 digits before calling into
cctz. 5 digits covers every realistic IRCv3 @time tag.
2026-04-25 10:36:53 +08:00
9ff31be416
Bump docker/login-action from 3 to 4
...
Bumps [docker/login-action](https://github.com/docker/login-action ) from 3 to 4.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/v3...v4 )
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: '4'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-01 15:21:14 +00:00
0fe69f3145
Bump codecov/codecov-action from 5 to 6
...
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action ) from 5 to 6.
- [Release notes](https://github.com/codecov/codecov-action/releases )
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/codecov/codecov-action/compare/v5...v6 )
---
updated-dependencies:
- dependency-name: codecov/codecov-action
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-01 15:21:09 +00:00
4825289561
Bump docker/metadata-action from 5 to 6
...
Bumps [docker/metadata-action](https://github.com/docker/metadata-action ) from 5 to 6.
- [Release notes](https://github.com/docker/metadata-action/releases )
- [Commits](https://github.com/docker/metadata-action/compare/v5...v6 )
---
updated-dependencies:
- dependency-name: docker/metadata-action
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-01 15:21:05 +00:00
05aa47bd91
Bump docker/build-push-action from 6 to 7
...
Bumps [docker/build-push-action](https://github.com/docker/build-push-action ) from 6 to 7.
- [Release notes](https://github.com/docker/build-push-action/releases )
- [Commits](https://github.com/docker/build-push-action/compare/v6...v7 )
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-01 15:20:59 +00:00
8566db72dd
Merge pull request #1995 from jabberwock/fix/getparamscolon-bounds-check
...
Message: add bounds check in GetParamsColon when uIdx >= params.size()
2026-03-17 18:05:39 +00:00
20908fc2d1
test: add GetParamsColon unit tests including out-of-bounds uIdx cases
2026-03-17 09:39:50 -07:00
94aeaa02bf
Message: add bounds check in GetParamsColon when uIdx >= params.size()
...
Without this check, when uIdx >= m_vsParams.size() and the vector is
non-empty, the subtraction in the clamp condition underflows to SIZE_MAX.
GetParamsSplit() already has the equivalent check at the top of the
function; this brings GetParamsColon() in line with it.
Fixes #1994
2026-03-17 09:39:50 -07:00
55d34645de
Merge pull request #1992 from TehPeGaSuS/patch-2
...
Fix formatting in ZNC connection message
2026-03-10 18:45:27 +00:00
4c0483adfa
Use user configured network
...
Use user configured network on the IRC client connection message example, so it turns from `/server <znc_server_ip> 1025 Admin:<pass>` to `/server <znc_server_ip> 1025 Admin/libera:<pass>`.
Should have done this from the start... 😅
2026-03-10 10:26:35 +01:00
9cb82dad06
Fix formatting in ZNC connection message
...
Make IRC client connection example consistent with the line above
2026-03-10 10:02:55 +01:00
e76c4df386
Bump actions/upload-artifact from 6 to 7
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 6 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-01 12:32:22 +00:00
84be3d0f0b
Merge pull request #1990 from danny8376/webadmin-pass-w-space
...
Fix webadmin serverlist parsing for password containing space
2026-02-27 00:00:45 +00:00
c2a760709c
Fix webadmin serverlist parsing for password containing space
2026-02-26 21:57:50 +08:00
ad7bd6d7ee
Don't try to join channel which ZNC is already on.
...
When Goguma connects to ZNC, it joins the joined channels again and
again, triggering flood protection.
Note: even with this fix, the Goguma+ZNC experience is still pretty bad
and requires doing something about repeating chat history
2026-01-26 22:15:23 +00:00
a187ae180e
Merge pull request #1987 from znc/dependabot/github_actions/actions/upload-artifact-6
...
Bump actions/upload-artifact from 5 to 6
2026-01-01 17:01:41 +00:00
e9a1f0d975
Merge pull request #1989 from Un1matr1x/issues/1988
...
Welcome to 2026
2026-01-01 14:55:26 +00:00
ad6a397ca4
Welcome to 2026
...
[skip ci]
2026-01-01 13:44:32 +01:00
bd99d51122
Bump actions/upload-artifact from 5 to 6
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 5 to 6.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v5...v6 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-01-01 12:01:34 +00:00
418628a0d9
Merge pull request #1985 from znc/dependabot/github_actions/actions/checkout-6
...
Bump actions/checkout from 5 to 6
2025-12-12 01:09:26 +00:00
fbfd391ec3
Update translations from Crowdin for bg_BG
2025-12-11 00:27:03 +00:00
1ae1b0a520
Bump actions/checkout from 5 to 6
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v5...v6 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2025-12-10 00:59:37 +00:00
d8b8c16783
Merge branch '1.10.x'
2025-12-10 00:55:07 +00:00
49af1c8d53
Fix build with SWIG 4.4
...
SWIG 4.4 has dropped the usage of SWIG_NULLPTR again, which means we can't
rely on its presence to identify SWIG >= 4.2.0
Generate a swig_version.h by parsing the output of `swig -version` and
writing this in a hex representation
Fixes #1979
2025-12-10 00:34:39 +00:00
18416d7df6
Update translations from Crowdin for
2025-12-06 00:26:11 +00:00
7c2571ff03
Update translations from Crowdin for
2025-12-06 00:26:10 +00:00
0d651d6f67
Update translations from Crowdin for de_DE
2025-11-20 00:26:22 +00:00
bfa58f6892
Update translations from Crowdin for de_DE
2025-11-20 00:26:21 +00:00
4aa81e07f6
Update translations from Crowdin for
2025-11-15 00:29:28 +00:00
7747f9bb1d
Update translations from Crowdin for
2025-11-15 00:29:23 +00:00
ea22b297fc
Update translations from Crowdin for de_DE nl_NL
2025-11-10 00:26:12 +00:00
4115baa9f4
Update translations from Crowdin for de_DE nl_NL
2025-11-10 00:26:11 +00:00
74a5da185c
Update translations from Crowdin for de_DE
2025-11-09 00:26:22 +00:00
3427c58246
Update translations from Crowdin for de_DE
2025-11-09 00:26:17 +00:00
7847b4c007
Update translations from Crowdin for
2025-11-08 00:26:26 +00:00
ZNC-Jenkins