Crash while adding channels to the web admin #318

Closed
opened 2026-10-05 04:12:57 +02:00 by adam · 9 comments
Owner

Adding an already existing channel to a user/network via web admin causes a crash if the channel name isn't prefixed with '#' (i.e you already have a channel '#potato' but you try to add 'potato' without the '#' prefix).

This only appears to happen if the channel is already in the list and not if you are adding a new channel that isn't already in the list.

Adding the following lines below "CString sChanName = WebSock.GetParam("name").Trim_n();" in modules/webadmin.cpp fixes this problem (although its probably not the best way of fixing it)

if(sChanName.substr(0, 1) != "#")
{
        sChanName = "#" + sChanName;
}
Adding an already existing channel to a user/network via web admin causes a crash if the channel name isn't prefixed with '#' (i.e you already have a channel '#potato' but you try to add 'potato' without the '#' prefix). This only appears to happen if the channel is already in the list and not if you are adding a new channel that isn't already in the list. Adding the following lines below "CString sChanName = WebSock.GetParam("name").Trim_n();" in modules/webadmin.cpp fixes this problem (although its probably not the best way of fixing it) ``` if(sChanName.substr(0, 1) != "#") { sChanName = "#" + sChanName; } ``` <!-- github-sync-id:31415773 -->
adam closed this issue 2026-10-05 04:12:57 +02:00
Author
Owner

A security release could be done?

A security release could be done? <!-- github-comment-id:40455910 -->
Author
Owner

@seblu yeah

@seblu yeah <!-- github-comment-id:40524881 -->
Author
Owner

soon?

soon? <!-- github-comment-id:40765990 -->
Author
Owner

I will backport the patch in Archlinux as there is still no security release.

I will backport the patch in Archlinux as there is still no security release. <!-- github-comment-id:42251924 -->
Author
Owner

Done

Done <!-- github-comment-id:42604227 -->
Author
Owner

This has been assigned CVE-2014-9403.

This has been assigned [CVE-2014-9403](http://seclists.org/oss-sec/2014/q4/1081). <!-- github-comment-id:67427859 -->
Author
Owner

1.6 will probably be released in near future.

[1.6](https://github.com/znc/znc/milestones/1.6) will probably be released in near future. <!-- github-comment-id:67445690 -->
Author
Owner

@Mikaela why 1.6 matters? 1.4 is fixed already

@Mikaela why 1.6 matters? 1.4 is fixed already <!-- github-comment-id:67459881 -->
Author
Owner

@DarthGandalf I thought this was something that is coming with 1.6 because of the new comment.

@DarthGandalf I thought this was something that is coming with 1.6 because of the new comment. <!-- github-comment-id:67462389 -->
Sign in to join this conversation.
No labels
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#318