From 57c4cb0c2695d339a01760dfe325f18516644699 Mon Sep 17 00:00:00 2001 From: reverse Date: Sat, 29 Aug 2026 03:08:47 +0000 Subject: [PATCH] opers: apply the usermode allowlist to +s (snomask) too +s has its own dispatch in apply_user_modes, so it bypassed the per-oper-type usermode allowlist. Gate it on can_use_mode('s') like the generic oper modes; non-opers are still rejected by apply_snomask, services under sudo pass through. --- src/coremods/core_mode.rs | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/src/coremods/core_mode.rs b/src/coremods/core_mode.rs index d4e0e69..3469e53 100644 --- a/src/coremods/core_mode.rs +++ b/src/coremods/core_mode.rs @@ -363,6 +363,19 @@ fn apply_user_modes(s: &mut Server, uid: Uid, target: &str, params: &[String]) - } else { None }; + // +s has its own dispatch, so apply the per-oper-type usermode allowlist here + // too (services under sudo pass through; non-opers are rejected by apply_snomask) + if adding + && !s.mode_sudo + && !crate::modules::opertypes::can_use_mode(s, uid, 's', false) + { + s.numeric( + uid, + ERR_NOPRIVILEGES, + ":Permission Denied- your oper type may not set that user mode", + ); + continue; + } if apply_snomask(s, uid, adding, param.as_deref()) { emit(&mut applied, &mut last, sign, c); }