commit f5ff22d98febeddcc51668c49f35940cbffe599e
from: Alexander Barton <alex@barton.de>
date: Wed Dec 07 23:14:00 2016 UTC

G-LINES: Forbid remote modifications if "AllowRemoteOper" is not set

Explicitely forbid remote servers to modify "x-lines" (G-LINES) when the
"AllowRemoteOper" configuration option isn't set, even when the command
seems to originate from the remote server itself: this prevents GLINE's
to become set during server handshake in this case (what wouldn't be
possible during regular runtime when a remote IRC Op sends the command)
and what can't be undone by IRC Ops later on (because of the missing
"AllowRemoteOper" option) ...

commit - 995bbfd62787a783a768cda9171f778a47099fa0
commit + f5ff22d98febeddcc51668c49f35940cbffe599e
blob - ee0a556349b3c113f5dd6841a01f42e9b9baabef
blob + cf3b9d0485436e03e1d1d63d74be85a4d7f901e8
--- src/ngircd/irc-oper.c
+++ src/ngircd/irc-oper.c
@@ -398,7 +398,16 @@ IRC_xLINE(CLIENT *Client, REQUEST *Req)
 		return IRC_WriteErrClient(Client, ERR_NEEDMOREPARAMS_MSG,
 					  Client_ID(Client), Req->command);
 
-	from = Op_Check(Client, Req);
+	if (!Conf_AllowRemoteOper && Client_Type(Client) == CLIENT_SERVER) {
+		/* Explicitely forbid remote servers to modify "x-lines" when
+		 * the "AllowRemoteOper" configuration option isn't set, even
+		 * when the command seems to originate from the remote server
+		 * itself: this prevents GLINE's to become set during server
+		 * handshake in this case (what wouldn't be possible during
+		 * regular runtime when a remote IRC Op sends the command). */
+		from = NULL;
+	} else
+		from = Op_Check(Client, Req);
 	if (!from)
 		return Op_NoPrivileges(Client, Req);