Merge branch 'master' into unix

2026-03-28 17:42:41 +01:00 · 2025-04-18 23:46:16 +01:00
parent 48dc52a0da a206d1a3bb
commit b53612edab
1234 changed files with 149930 additions and 10349 deletions
--- a/modules/webadmin.cpp
+++ b/modules/webadmin.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2017 ZNC, see the NOTICE file for details.
+ * Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -191,7 +191,7 @@ class CWebAdminMod : public CModule {

        if (pUser) {
            /* If we are editing a user we must not change the user name */
-            sUsername = pUser->GetUserName();
+            sUsername = pUser->GetUsername();
        }

        CString sArg = WebSock.GetParam("password");
@@ -210,6 +210,15 @@ class CWebAdminMod : public CModule {
            pNewUser->SetPass(sHash, CUser::HASH_DEFAULT, sSalt);
        }

+        sArg = WebSock.GetParam("authonlyviamodule");
+        if (spSession->IsAdmin()) {
+            if (!sArg.empty()) {
+                pNewUser->SetAuthOnlyViaModule(sArg.ToBool());
+            }
+        } else if (pUser) {
+            pNewUser->SetAuthOnlyViaModule(pUser->AuthOnlyViaModule());
+        }
+
        VCString vsArgs;

        WebSock.GetRawParam("allowedips").Split("\n", vsArgs);
@@ -222,9 +231,11 @@ class CWebAdminMod : public CModule {
        }

        WebSock.GetRawParam("ctcpreplies").Split("\n", vsArgs);
-        for (const CString& sReply : vsArgs) {
-            pNewUser->AddCTCPReply(sReply.Token(0).Trim_n(),
-                                   sReply.Token(1, true).Trim_n());
+        if (spSession->IsAdmin() || !spSession->GetUser()->DenySetCTCPReplies()) {
+            for (const CString& sReply : vsArgs) {
+                pNewUser->AddCTCPReply(sReply.Token(0).Trim_n(),
+                                    sReply.Token(1, true).Trim_n());
+            }
        }

        sArg = WebSock.GetParam("nick");
@@ -240,16 +251,28 @@ class CWebAdminMod : public CModule {
            pNewUser->SetStatusPrefix(sArg);
        }
        sArg = WebSock.GetParam("ident");
-        if (!sArg.empty()) {
-            pNewUser->SetIdent(sArg);
+        if (spSession->IsAdmin() || !spSession->GetUser()->DenySetIdent()) {
+            if (!sArg.empty()) {
+                pNewUser->SetIdent(sArg);
+            }
+        } else if (pUser) {
+            pNewUser->SetIdent(pUser->GetIdent());
        }
        sArg = WebSock.GetParam("realname");
-        if (!sArg.empty()) {
-            pNewUser->SetRealName(sArg);
+        if (spSession->IsAdmin() || !spSession->GetUser()->DenySetRealName()) {
+            if (!sArg.empty()) {
+                pNewUser->SetRealName(sArg);
+            }
+        } else if (pUser) {
+            pNewUser->SetRealName(pUser->GetRealName());
        }
        sArg = WebSock.GetParam("quitmsg");
-        if (!sArg.empty()) {
-            pNewUser->SetQuitMsg(sArg);
+        if (spSession->IsAdmin() || !spSession->GetUser()->DenySetQuitMsg()) {
+            if (!sArg.empty()) {
+                pNewUser->SetQuitMsg(sArg);
+            }
+        } else if (pUser) {
+            pNewUser->SetQuitMsg(pUser->GetQuitMsg());
        }
        sArg = WebSock.GetParam("chanmodes");
        if (!sArg.empty()) {
@@ -344,11 +367,29 @@ class CWebAdminMod : public CModule {
            pNewUser->SetDenyLoadMod(WebSock.GetParam("denyloadmod").ToBool());
            pNewUser->SetDenySetBindHost(
                WebSock.GetParam("denysetbindhost").ToBool());
+            pNewUser->SetDenySetIdent(
+                WebSock.GetParam("denysetident").ToBool());
+            pNewUser->SetDenySetNetwork(
+                WebSock.GetParam("denysetnetwork").ToBool());
+            pNewUser->SetDenySetRealName(
+                WebSock.GetParam("denysetrealname").ToBool());
+            pNewUser->SetDenySetQuitMsg(
+                WebSock.GetParam("denysetquitmsg").ToBool());
+            pNewUser->SetDenySetCTCPReplies(
+                WebSock.GetParam("denysetctcpreplies").ToBool());
+            pNewUser->SetAuthOnlyViaModule(
+                WebSock.GetParam("authonlyviamodule").ToBool());
            sArg = WebSock.GetParam("maxnetworks");
            if (!sArg.empty()) pNewUser->SetMaxNetworks(sArg.ToUInt());
        } else if (pUser) {
            pNewUser->SetDenyLoadMod(pUser->DenyLoadMod());
            pNewUser->SetDenySetBindHost(pUser->DenySetBindHost());
+            pNewUser->SetDenySetIdent(pUser->DenySetIdent());
+            pNewUser->SetDenySetNetwork(pUser->DenySetNetwork());
+            pNewUser->SetDenySetRealName(pUser->DenySetRealName());
+            pNewUser->SetDenySetQuitMsg(pUser->DenySetQuitMsg());
+            pNewUser->SetDenySetCTCPReplies(pUser->DenySetCTCPReplies());
+            pNewUser->SetAuthOnlyViaModule(pUser->AuthOnlyViaModule());
            pNewUser->SetMaxNetworks(pUser->MaxNetworks());
        }

@@ -439,14 +480,14 @@ class CWebAdminMod : public CModule {
        return pNewUser;
    }

-    CString SafeGetUserNameParam(CWebSock& WebSock) {
-        CString sUserName = WebSock.GetParam("user");  // check for POST param
-        if (sUserName.empty() && !WebSock.IsPost()) {
+    CString SafeGetUsernameParam(CWebSock& WebSock) {
+        CString sUsername = WebSock.GetParam("user");  // check for POST param
+        if (sUsername.empty() && !WebSock.IsPost()) {
            // if no POST param named user has been given and we are not
            // saving this form, fall back to using the GET parameter.
-            sUserName = WebSock.GetParam("user", false);
+            sUsername = WebSock.GetParam("user", false);
        }
-        return sUserName;
+        return sUsername;
    }

    CString SafeGetNetworkParam(CWebSock& WebSock) {
@@ -460,11 +501,11 @@ class CWebAdminMod : public CModule {
    }

    CUser* SafeGetUserFromParam(CWebSock& WebSock) {
-        return CZNC::Get().FindUser(SafeGetUserNameParam(WebSock));
+        return CZNC::Get().FindUser(SafeGetUsernameParam(WebSock));
    }

    CIRCNetwork* SafeGetNetworkFromParam(CWebSock& WebSock) {
-        CUser* pUser = CZNC::Get().FindUser(SafeGetUserNameParam(WebSock));
+        CUser* pUser = CZNC::Get().FindUser(SafeGetUsernameParam(WebSock));
        CIRCNetwork* pNetwork = nullptr;

        if (pUser) {
@@ -502,11 +543,16 @@ class CWebAdminMod : public CModule {
                return false;
            }

-            if (pUser) {
+            if (!pUser) {
+                WebSock.PrintErrorPage(t_s("No such user"));
+                return true;
+            }
+
+            if (spSession->IsAdmin() || !spSession->GetUser()->DenySetNetwork()) {
                return NetworkPage(WebSock, Tmpl, pUser);
            }

-            WebSock.PrintErrorPage(t_s("No such user"));
+            WebSock.PrintErrorPage(t_s("Permission denied"));
            return true;
        } else if (sPageName == "editnetwork") {
            CIRCNetwork* pNetwork = SafeGetNetworkFromParam(WebSock);
@@ -539,7 +585,12 @@ class CWebAdminMod : public CModule {
                return false;
            }

-            return DelNetwork(WebSock, pUser, Tmpl);
+            if (spSession->IsAdmin() || !spSession->GetUser()->DenySetNetwork()) {
+                return DelNetwork(WebSock, pUser, Tmpl);
+            }
+
+            WebSock.PrintErrorPage(t_s("Permission denied"));
+            return true;
        } else if (sPageName == "editchan") {
            CIRCNetwork* pNetwork = SafeGetNetworkFromParam(WebSock);

@@ -638,11 +689,11 @@ class CWebAdminMod : public CModule {
            WebSock.PrintErrorPage(t_s("No such user"));
            return true;
        } else if (sPageName == "edituser") {
-            CString sUserName = SafeGetUserNameParam(WebSock);
-            CUser* pUser = CZNC::Get().FindUser(sUserName);
+            CString sUsername = SafeGetUsernameParam(WebSock);
+            CUser* pUser = CZNC::Get().FindUser(sUsername);

            if (!pUser) {
-                if (sUserName.empty()) {
+                if (sUsername.empty()) {
                    pUser = spSession->GetUser();
                }  // else: the "no such user" message will be printed.
            }
@@ -696,17 +747,17 @@ class CWebAdminMod : public CModule {
        }

        if (!WebSock.GetParam("submitted").ToUInt()) {
-            Tmpl["User"] = pUser->GetUserName();
+            Tmpl["User"] = pUser->GetUsername();
            Tmpl["Network"] = pNetwork->GetName();

            CTemplate& breadUser = Tmpl.AddRow("BreadCrumbs");
-            breadUser["Text"] = t_f("Edit User [{1}]")(pUser->GetUserName());
+            breadUser["Text"] = t_f("Edit User [{1}]")(pUser->GetUsername());
            breadUser["URL"] =
-                GetWebPath() + "edituser?user=" + pUser->GetUserName();
+                GetWebPath() + "edituser?user=" + pUser->GetUsername();
            CTemplate& breadNet = Tmpl.AddRow("BreadCrumbs");
            breadNet["Text"] = t_f("Edit Network [{1}]")(pNetwork->GetName());
            breadNet["URL"] = GetWebPath() + "editnetwork?user=" +
-                              pUser->GetUserName() + "&network=" +
+                              pUser->GetUsername() + "&network=" +
                              pNetwork->GetName();
            CTemplate& breadChan = Tmpl.AddRow("BreadCrumbs");

@@ -716,7 +767,7 @@ class CWebAdminMod : public CModule {
                Tmpl["Title"] =
                    t_f("Edit Channel [{1}] of Network [{2}] of User [{3}]")(
                        pChan->GetName(), pNetwork->GetName(),
-                        pUser->GetUserName());
+                        pUser->GetUsername());
                Tmpl["ChanName"] = pChan->GetName();
                Tmpl["BufferSize"] = CString(pChan->GetBufferCount());
                Tmpl["DefModes"] = pChan->GetDefaultModes();
@@ -730,7 +781,7 @@ class CWebAdminMod : public CModule {
                Tmpl["Action"] = "addchan";
                Tmpl["Title"] =
                    t_f("Add Channel to Network [{1}] of User [{2}]")(
-                        pNetwork->GetName(), pUser->GetUserName());
+                        pNetwork->GetName(), pUser->GetUsername());
                Tmpl["BufferSize"] = CString(pUser->GetBufferCount());
                Tmpl["DefModes"] = CString(pUser->GetDefaultChanModes());
                Tmpl["InConfig"] = "true";
@@ -741,9 +792,9 @@ class CWebAdminMod : public CModule {

            CTemplate& o2 = Tmpl.AddRow("OptionLoop");
            o2["Name"] = "autoclearchanbuffer";
-            o2["DisplayName"] = t_s("Auto Clear Chan Buffer");
+            o2["DisplayName"] = t_s("Auto clear chan buffer");
            o2["Tooltip"] =
-                t_s("Automatically Clear Channel Buffer After Playback");
+                t_s("Automatically clear channel buffer after playback");
            if ((pChan && pChan->AutoClearChanBuffer()) ||
                (!pChan && pUser->AutoClearChanBuffer())) {
                o2["Checked"] = "true";
@@ -837,7 +888,7 @@ class CWebAdminMod : public CModule {
            pChan->Disable();

        CTemplate TmplMod;
-        TmplMod["User"] = pUser->GetUserName();
+        TmplMod["User"] = pUser->GetUsername();
        TmplMod["ChanName"] = pChan->GetName();
        TmplMod["WebadminAction"] = "change";
        FOR_EACH_MODULE(it, pNetwork) {
@@ -852,13 +903,13 @@ class CWebAdminMod : public CModule {

        if (WebSock.HasParam("submit_return")) {
            WebSock.Redirect(GetWebPath() + "editnetwork?user=" +
-                             pUser->GetUserName().Escape_n(CString::EURL) +
+                             pUser->GetUsername().Escape_n(CString::EURL) +
                             "&network=" +
                             pNetwork->GetName().Escape_n(CString::EURL));
        } else {
            WebSock.Redirect(
                GetWebPath() + "editchan?user=" +
-                pUser->GetUserName().Escape_n(CString::EURL) + "&network=" +
+                pUser->GetUsername().Escape_n(CString::EURL) + "&network=" +
                pNetwork->GetName().Escape_n(CString::EURL) + "&name=" +
                pChan->GetName().Escape_n(CString::EURL));
        }
@@ -870,8 +921,28 @@ class CWebAdminMod : public CModule {
        std::shared_ptr<CWebSession> spSession = WebSock.GetSession();
        Tmpl.SetFile("add_edit_network.tmpl");

+        if (!pNetwork && !spSession->IsAdmin() && pUser->DenySetNetwork()) {
+            WebSock.PrintErrorPage(t_s("Permission denied"));
+            return true;
+        }
+
+        if (!pNetwork && !spSession->IsAdmin() &&
+            !pUser->HasSpaceForNewNetwork()) {
+            WebSock.PrintErrorPage(t_s(
+                "Network number limit reached. Ask an admin to increase the "
+                "limit for you, or delete unneeded networks from Your "
+                "Settings."));
+            return true;
+        }
+
        if (!WebSock.GetParam("submitted").ToUInt()) {
-            Tmpl["Username"] = pUser->GetUserName();
+            Tmpl["Username"] = pUser->GetUsername();
+
+            CTemplate& breadUser = Tmpl.AddRow("BreadCrumbs");
+            breadUser["Text"] = t_f("Edit User [{1}]")(pUser->GetUsername());
+            breadUser["URL"] =
+                GetWebPath() + "edituser?user=" + pUser->GetUsername();
+
            CTemplate& breadNet = Tmpl.AddRow("BreadCrumbs");

            CIRCNetwork EmptyNetwork(pUser, "");
@@ -880,21 +951,13 @@ class CWebAdminMod : public CModule {
                Tmpl["Action"] = "editnetwork";
                Tmpl["Edit"] = "true";
                Tmpl["Title"] = t_f("Edit Network [{1}] of User [{2}]")(
-                    pNetwork->GetName(), pUser->GetUserName());
+                    pNetwork->GetName(), pUser->GetUsername());
                breadNet["Text"] =
                    t_f("Edit Network [{1}]")(pNetwork->GetName());
            } else {
-                if (!spSession->IsAdmin() && !pUser->HasSpaceForNewNetwork()) {
-                    WebSock.PrintErrorPage(
-                        t_s("Network number limit reached. Ask an admin to "
-                            "increase the limit for you, or delete unneeded "
-                            "networks from Your Settings."));
-                    return true;
-                }
-
                Tmpl["Action"] = "addnetwork";
                Tmpl["Title"] =
-                    t_f("Add Network for User [{1}]")(pUser->GetUserName());
+                    t_f("Add Network for User [{1}]")(pUser->GetUsername());
                breadNet["Text"] = t_s("Add Network");

                pNetwork = &EmptyNetwork;
@@ -955,20 +1018,37 @@ class CWebAdminMod : public CModule {
                Tmpl["BindHost"] = pNetwork->GetBindHost();
            }

-            CTemplate& breadUser = Tmpl.AddRow("BreadCrumbs");
-            breadUser["Text"] = t_f("Edit User [{1}]")(pUser->GetUserName());
-            breadUser["URL"] =
-                GetWebPath() + "edituser?user=" + pUser->GetUserName();
+            if (spSession->IsAdmin() ||
+                !spSession->GetUser()->DenySetNetwork()) {
+                Tmpl["NameEdit"] = "true";
+            }

            Tmpl["Name"] = pNetwork->GetName();
-
            Tmpl["Nick"] = pNetwork->GetNick();
            Tmpl["AltNick"] = pNetwork->GetAltNick();
+
+            if (spSession->IsAdmin() ||
+                !spSession->GetUser()->DenySetIdent()) {
+                Tmpl["IdentEdit"] = "true";
+            }
            Tmpl["Ident"] = pNetwork->GetIdent();
+
+            if (spSession->IsAdmin() ||
+                !spSession->GetUser()->DenySetRealName()) {
+                Tmpl["RealNameEdit"] = "true";
+            }
            Tmpl["RealName"] = pNetwork->GetRealName();

+            if (spSession->IsAdmin() ||
+                !spSession->GetUser()->DenySetQuitMsg()) {
+                Tmpl["QuitMsgEdit"] = "true";
+            }
            Tmpl["QuitMsg"] = pNetwork->GetQuitMsg();

+            Tmpl["NetworkEdit"] =
+                spSession->IsAdmin() || !spSession->GetUser()->DenySetNetwork()
+                ? "true" : "false";
+
            Tmpl["FloodProtection"] =
                CString(CIRCSock::IsFloodProtected(pNetwork->GetFloodRate()));
            Tmpl["FloodRate"] = CString(pNetwork->GetFloodRate());
@@ -988,11 +1068,12 @@ class CWebAdminMod : public CModule {
            }

            const vector<CChan*>& Channels = pNetwork->GetChans();
+            unsigned int uIndex = 1;
            for (const CChan* pChan : Channels) {
                CTemplate& l = Tmpl.AddRow("ChannelLoop");

                l["Network"] = pNetwork->GetName();
-                l["Username"] = pUser->GetUserName();
+                l["Username"] = pUser->GetUsername();
                l["Name"] = pChan->GetName();
                l["Perms"] = pChan->GetPermStr();
                l["CurModes"] = pChan->GetModeString();
@@ -1008,6 +1089,9 @@ class CWebAdminMod : public CModule {
                if (pChan->InConfig()) {
                    l["InConfig"] = "true";
                }
+
+                l["MaxIndex"] = CString(Channels.size());
+                l["Index"] = CString(uIndex++);
            }
            for (const CString& sFP : pNetwork->GetTrustedFingerprints()) {
                CTemplate& l = Tmpl.AddRow("TrustedFingerprints");
@@ -1060,30 +1144,24 @@ class CWebAdminMod : public CModule {
            WebSock.PrintErrorPage(t_s("Network name is a required argument"));
            return true;
        }
-        if (!pNetwork && !spSession->IsAdmin() &&
-            !pUser->HasSpaceForNewNetwork()) {
-            WebSock.PrintErrorPage(t_s(
-                "Network number limit reached. Ask an admin to increase the "
-                "limit for you, or delete unneeded networks from Your "
-                "Settings."));
-            return true;
-        }
-        if (!pNetwork || pNetwork->GetName() != sName) {
-            CString sNetworkAddError;
-            CIRCNetwork* pOldNetwork = pNetwork;
-            pNetwork = pUser->AddNetwork(sName, sNetworkAddError);
-            if (!pNetwork) {
-                WebSock.PrintErrorPage(sNetworkAddError);
-                return true;
-            }
-            if (pOldNetwork) {
-                for (CModule* pModule : pOldNetwork->GetModules()) {
-                    CString sPath = pUser->GetUserPath() + "/networks/" +
-                                    sName + "/moddata/" + pModule->GetModName();
-                    pModule->MoveRegistry(sPath);
+        if (spSession->IsAdmin() || !spSession->GetUser()->DenySetNetwork()) {
+            if (!pNetwork || pNetwork->GetName() != sName) {
+                CString sNetworkAddError;
+                CIRCNetwork* pOldNetwork = pNetwork;
+                pNetwork = pUser->AddNetwork(sName, sNetworkAddError);
+                if (!pNetwork) {
+                    WebSock.PrintErrorPage(sNetworkAddError);
+                    return true;
+                }
+                if (pOldNetwork) {
+                    for (CModule* pModule : pOldNetwork->GetModules()) {
+                        CString sPath = pUser->GetUserPath() + "/networks/" +
+                                        sName + "/moddata/" + pModule->GetModName();
+                        pModule->MoveRegistry(sPath);
+                    }
+                    pNetwork->Clone(*pOldNetwork, false);
+                    pUser->DeleteNetwork(pOldNetwork->GetName());
                }
-                pNetwork->Clone(*pOldNetwork, false);
-                pUser->DeleteNetwork(pOldNetwork->GetName());
            }
        }

@@ -1091,10 +1169,18 @@ class CWebAdminMod : public CModule {

        pNetwork->SetNick(WebSock.GetParam("nick"));
        pNetwork->SetAltNick(WebSock.GetParam("altnick"));
-        pNetwork->SetIdent(WebSock.GetParam("ident"));
-        pNetwork->SetRealName(WebSock.GetParam("realname"));

-        pNetwork->SetQuitMsg(WebSock.GetParam("quitmsg"));
+        if (spSession->IsAdmin() || !spSession->GetUser()->DenySetIdent()) {
+            pNetwork->SetIdent(WebSock.GetParam("ident"));
+        }
+
+        if (spSession->IsAdmin() || !spSession->GetUser()->DenySetRealName()) {
+            pNetwork->SetRealName(WebSock.GetParam("realname"));
+        }
+
+        if (spSession->IsAdmin() || !spSession->GetUser()->DenySetQuitMsg()) {
+            pNetwork->SetQuitMsg(WebSock.GetParam("quitmsg"));
+        }

        pNetwork->SetIRCConnectEnabled(WebSock.GetParam("doconnect").ToBool());

@@ -1136,10 +1222,12 @@ class CWebAdminMod : public CModule {

        VCString vsArgs;

-        pNetwork->DelServers();
-        WebSock.GetRawParam("servers").Split("\n", vsArgs);
-        for (const CString& sServer : vsArgs) {
-            pNetwork->AddServer(sServer.Trim_n());
+        if (spSession->IsAdmin() || !spSession->GetUser()->DenySetNetwork()) {
+            pNetwork->DelServers();
+            WebSock.GetRawParam("servers").Split("\n", vsArgs);
+            for (const CString& sServer : vsArgs) {
+                pNetwork->AddServer(sServer.Trim_n());
+            }
        }

        WebSock.GetRawParam("fingerprints").Split("\n", vsArgs);
@@ -1152,6 +1240,13 @@ class CWebAdminMod : public CModule {
        for (const CString& sChan : vsArgs) {
            CChan* pChan = pNetwork->FindChan(sChan.TrimRight_n("\r"));
            if (pChan) {
+                CString sError;
+                if (!pNetwork->MoveChan(
+                        sChan, WebSock.GetParam("index_" + sChan).ToUInt() - 1,
+                        sError)) {
+                    WebSock.PrintErrorPage(sError);
+                    return true;
+                }
                pChan->SetInConfig(WebSock.GetParam("save_" + sChan).ToBool());
            }
        }
@@ -1209,7 +1304,7 @@ class CWebAdminMod : public CModule {
        }

        CTemplate TmplMod;
-        TmplMod["Username"] = pUser->GetUserName();
+        TmplMod["Username"] = pUser->GetUsername();
        TmplMod["Name"] = pNetwork->GetName();
        TmplMod["WebadminAction"] = "change";
        FOR_EACH_MODULE(it, make_pair(pUser, pNetwork)) {
@@ -1224,10 +1319,10 @@ class CWebAdminMod : public CModule {

        if (WebSock.HasParam("submit_return")) {
            WebSock.Redirect(GetWebPath() + "edituser?user=" +
-                             pUser->GetUserName().Escape_n(CString::EURL));
+                             pUser->GetUsername().Escape_n(CString::EURL));
        } else {
            WebSock.Redirect(GetWebPath() + "editnetwork?user=" +
-                             pUser->GetUserName().Escape_n(CString::EURL) +
+                             pUser->GetUsername().Escape_n(CString::EURL) +
                             "&network=" +
                             pNetwork->GetName().Escape_n(CString::EURL));
        }
@@ -1255,7 +1350,7 @@ class CWebAdminMod : public CModule {
            // Show the "Are you sure?" page:

            Tmpl.SetFile("del_network.tmpl");
-            Tmpl["Username"] = pUser->GetUserName();
+            Tmpl["Username"] = pUser->GetUsername();
            Tmpl["Network"] = sNetwork;
            return true;
        }
@@ -1269,7 +1364,7 @@ class CWebAdminMod : public CModule {
        }

        WebSock.Redirect(GetWebPath() + "edituser?user=" +
-                         pUser->GetUserName().Escape_n(CString::EURL));
+                         pUser->GetUsername().Escape_n(CString::EURL));
        return false;
    }

@@ -1293,7 +1388,7 @@ class CWebAdminMod : public CModule {

        WebSock.Redirect(
            GetWebPath() + "editnetwork?user=" +
-            pNetwork->GetUser()->GetUserName().Escape_n(CString::EURL) +
+            pNetwork->GetUser()->GetUsername().Escape_n(CString::EURL) +
            "&network=" + pNetwork->GetName().Escape_n(CString::EURL));
        return false;
    }
@@ -1306,7 +1401,7 @@ class CWebAdminMod : public CModule {
            CUser EmptyUser("");
            CUser* pRealUser = pUser;
            if (pUser) {
-                Tmpl["Title"] = t_f("Edit User [{1}]")(pUser->GetUserName());
+                Tmpl["Title"] = t_f("Edit User [{1}]")(pUser->GetUsername());
                Tmpl["Edit"] = "true";
            } else {
                CString sUsername = WebSock.GetParam("clone", false);
@@ -1315,9 +1410,9 @@ class CWebAdminMod : public CModule {

                if (pUser) {
                    Tmpl["Title"] =
-                        t_f("Clone User [{1}]")(pUser->GetUserName());
+                        t_f("Clone User [{1}]")(pUser->GetUsername());
                    Tmpl["Clone"] = "true";
-                    Tmpl["CloneUsername"] = pUser->GetUserName();
+                    Tmpl["CloneUsername"] = pUser->GetUsername();
                } else {
                    pUser = &EmptyUser;
                    Tmpl["Title"] = "Add User";
@@ -1326,13 +1421,38 @@ class CWebAdminMod : public CModule {

            Tmpl["ImAdmin"] = CString(spSession->IsAdmin());

-            Tmpl["Username"] = pUser->GetUserName();
+            Tmpl["Username"] = pUser->GetUsername();
+            Tmpl["AuthOnlyViaModule"] = CString(pUser->AuthOnlyViaModule());
            Tmpl["Nick"] = pUser->GetNick();
            Tmpl["AltNick"] = pUser->GetAltNick();
            Tmpl["StatusPrefix"] = pUser->GetStatusPrefix();
-            Tmpl["Ident"] = pUser->GetIdent();
-            Tmpl["RealName"] = pUser->GetRealName();
-            Tmpl["QuitMsg"] = pUser->GetQuitMsg();
+
+            if (spSession->IsAdmin() ||
+                !spSession->GetUser()->DenySetIdent()) {
+                Tmpl["IdentEdit"] = "true";
+                Tmpl["Ident"] = pUser->GetIdent();
+            }
+
+            if (spSession->IsAdmin() ||
+                !spSession->GetUser()->DenySetRealName()) {
+                Tmpl["RealNameEdit"] = "true";
+                Tmpl["RealName"] = pUser->GetRealName();
+            }
+
+            if (spSession->IsAdmin() ||
+                !spSession->GetUser()->DenySetQuitMsg()) {
+                Tmpl["QuitMsgEdit"] = "true";
+                Tmpl["QuitMsg"] = pUser->GetQuitMsg();
+            }
+
+            Tmpl["NetworkEdit"] =
+                spSession->IsAdmin() || !spSession->GetUser()->DenySetNetwork()
+                ? "true" : "false";
+
+            Tmpl["CTCPEdit"] =
+                spSession->IsAdmin() || !spSession->GetUser()->DenySetCTCPReplies()
+                ? "true" : "false";
+
            Tmpl["DefaultChanModes"] = pUser->GetDefaultChanModes();
            Tmpl["ChanBufferSize"] = CString(pUser->GetChanBufferSize());
            Tmpl["QueryBufferSize"] = CString(pUser->GetQueryBufferSize());
@@ -1355,7 +1475,7 @@ class CWebAdminMod : public CModule {
            for (const CIRCNetwork* pNetwork : vNetworks) {
                CTemplate& l = Tmpl.AddRow("NetworkLoop");
                l["Name"] = pNetwork->GetName();
-                l["Username"] = pUser->GetUserName();
+                l["Username"] = pUser->GetUsername();
                l["Clients"] = CString(pNetwork->GetClients().size());
                l["IRCNick"] = pNetwork->GetIRCNick().GetNick();
                CServer* pServer = pNetwork->GetCurrentServer();
@@ -1501,9 +1621,9 @@ class CWebAdminMod : public CModule {

            CTemplate& o1 = Tmpl.AddRow("OptionLoop");
            o1["Name"] = "autoclearchanbuffer";
-            o1["DisplayName"] = t_s("Auto Clear Chan Buffer");
+            o1["DisplayName"] = t_s("Auto clear chan buffer");
            o1["Tooltip"] =
-                t_s("Automatically Clear Channel Buffer After Playback (the "
+                t_s("Automatically clear channel buffer after playback (the "
                    "default value for new channels)");
            if (pUser->AutoClearChanBuffer()) {
                o1["Checked"] = "true";
@@ -1513,21 +1633,21 @@ class CWebAdminMod : public CModule {

            CTemplate& o4 = Tmpl.AddRow("OptionLoop");
            o4["Name"] = "multiclients";
-            o4["DisplayName"] = t_s("Multi Clients");
+            o4["DisplayName"] = t_s("Allow multiple clients");
            if (pUser->MultiClients()) {
                o4["Checked"] = "true";
            }

            CTemplate& o7 = Tmpl.AddRow("OptionLoop");
            o7["Name"] = "appendtimestamp";
-            o7["DisplayName"] = t_s("Append Timestamps");
+            o7["DisplayName"] = t_s("Append timestamps");
            if (pUser->GetTimestampAppend()) {
                o7["Checked"] = "true";
            }

            CTemplate& o8 = Tmpl.AddRow("OptionLoop");
            o8["Name"] = "prependtimestamp";
-            o8["DisplayName"] = t_s("Prepend Timestamps");
+            o8["DisplayName"] = t_s("Prepend timestamps");
            if (pUser->GetTimestampPrepend()) {
                o8["Checked"] = "true";
            }
@@ -1542,7 +1662,7 @@ class CWebAdminMod : public CModule {

                CTemplate& o10 = Tmpl.AddRow("OptionLoop");
                o10["Name"] = "isadmin";
-                o10["DisplayName"] = t_s("Admin");
+                o10["DisplayName"] = t_s("Admin (dangerous! may gain shell access)");
                if (pUser->IsAdmin()) {
                    o10["Checked"] = "true";
                }
@@ -1552,19 +1672,58 @@ class CWebAdminMod : public CModule {

                CTemplate& o11 = Tmpl.AddRow("OptionLoop");
                o11["Name"] = "denysetbindhost";
-                o11["DisplayName"] = t_s("Deny SetBindHost");
+                o11["DisplayName"] = t_s("Deny setting BindHost");
                if (pUser->DenySetBindHost()) {
                    o11["Checked"] = "true";
                }
+
+                CTemplate& o12 = Tmpl.AddRow("OptionLoop");
+                o12["Name"] = "denysetident";
+                o12["DisplayName"] = t_s("Deny setting Ident");
+                if (pUser->DenySetIdent()) {
+                    o12["Checked"] = "true";
+                }
+
+                CTemplate& o13 = Tmpl.AddRow("OptionLoop");
+                o13["Name"] = "denysetnetwork";
+                o13["DisplayName"] = t_s("Deny editing networks/servers");
+                o13["Tooltip"] =
+                    t_s("Deny adding/deleting networks, setting network name and editing the server list");
+                if (pUser->DenySetNetwork()) {
+                    o13["Checked"] = "true";
+                }
+
+                CTemplate& o14 = Tmpl.AddRow("OptionLoop");
+                o14["Name"] = "denysetrealname";
+                o14["DisplayName"] = t_s("Deny setting RealName");
+                if (pUser->DenySetRealName()) {
+                    o14["Checked"] = "true";
+                }
+
+                CTemplate& o15 = Tmpl.AddRow("OptionLoop");
+                o15["Name"] = "denysetquitmsg";
+                o15["DisplayName"] = t_s("Deny setting quit message");
+                if (pUser->DenySetQuitMsg()) {
+                    o15["Checked"] = "true";
+                }
+
+                CTemplate& o16 = Tmpl.AddRow("OptionLoop");
+                o16["Name"] = "denysetctcpreplies";
+                o16["DisplayName"] = t_s("Deny setting CTCP replies");
+                o16["Tooltip"] =
+                    t_s("Block customizing CTCP replies for non-admin users");
+                if (pUser->DenySetCTCPReplies()) {
+                    o16["Checked"] = "true";
+                }
            }

-            CTemplate& o12 = Tmpl.AddRow("OptionLoop");
-            o12["Name"] = "autoclearquerybuffer";
-            o12["DisplayName"] = t_s("Auto Clear Query Buffer");
-            o12["Tooltip"] =
-                t_s("Automatically Clear Query Buffer After Playback");
+            CTemplate& o17 = Tmpl.AddRow("OptionLoop");
+            o17["Name"] = "autoclearquerybuffer";
+            o17["DisplayName"] = t_s("Auto clear query buffer");
+            o17["Tooltip"] =
+                t_s("Automatically clear query buffer after playback");
            if (pUser->AutoClearQueryBuffer()) {
-                o12["Checked"] = "true";
+                o17["Checked"] = "true";
            }

            FOR_EACH_MODULE(i, pUser) {
@@ -1644,7 +1803,7 @@ class CWebAdminMod : public CModule {
            WebSock.Redirect(GetWebPath() + "listusers");
        } else {
            WebSock.Redirect(GetWebPath() + "edituser?user=" +
-                             pUser->GetUserName());
+                             pUser->GetUsername());
        }

        /* we don't want the template to be printed while we redirect */
@@ -1661,7 +1820,7 @@ class CWebAdminMod : public CModule {
            CTemplate& l = Tmpl.AddRow("UserLoop");
            CUser* pUser = it.second;

-            l["Username"] = pUser->GetUserName();
+            l["Username"] = pUser->GetUsername();
            l["Clients"] = CString(pUser->GetAllClients().size());
            l["Networks"] = CString(pUser->GetNetworks().size());

@@ -1720,7 +1879,7 @@ class CWebAdminMod : public CModule {

        for (const auto& it : traffic) {
            if (!spSession->IsAdmin() &&
-                !spSession->GetUser()->GetUserName().Equals(it.first)) {
+                !spSession->GetUser()->GetUsername().Equals(it.first)) {
                continue;
            }

@@ -1872,6 +2031,7 @@ class CWebAdminMod : public CModule {
            Tmpl["ProtectWebSessions"] =
                CString(CZNC::Get().GetProtectWebSessions());
            Tmpl["HideVersion"] = CString(CZNC::Get().GetHideVersion());
+            Tmpl["AuthOnlyViaModule"] = CString(CZNC::Get().GetAuthOnlyViaModule());

            const VCString& vsMotd = CZNC::Get().GetMotd();
            for (const CString& sMotd : vsMotd) {
@@ -2026,6 +2186,8 @@ class CWebAdminMod : public CModule {
        CZNC::Get().SetProtectWebSessions(sArg.ToBool());
        sArg = WebSock.GetParam("hideversion");
        CZNC::Get().SetHideVersion(sArg.ToBool());
+        sArg = WebSock.GetParam("authonlyviamodule");
+        CZNC::Get().SetAuthOnlyViaModule(sArg.ToBool());

        VCString vsArgs;
        WebSock.GetRawParam("motd").Split("\n", vsArgs);