search

ergochat / ergo

A modern IRC server (daemon/ircd) written in Go.
https://ergo.chat/
MIT License
2.2k stars 175 forks source link

rehash with channel registration disabled is unsafe #2130

Closed slingamn closed 4 months ago

slingamn commented 4 months ago

Reported by eta in #ergo. loadRegisteredChannels does not check the current config value, which is probably correct: even if new channel registration is disallowed, we want to load existing registered channels. However, this case is buggy:

https://github.com/ergochat/ergo/blob/4d9e80fe5be8dcd9892df22247461522974a7c88/irc/server.go#L705-L707

This will unconditionally reload the registered channels and overwrite their entries in the channel manager. I think we can actually just delete this, since we are loading the registered channels unconditionally on startup?

slingamn commented 4 months ago

Recommended workaround for anyone affected: set channels.registration.enabled to true, but set channels.registration.operator-only to true as well.