Gate OperServ INFO note edits at admin and cap the MemoServ ignore list

modules/memoserv/src/ignore.rs

@@ -10,6 +10,13 @@ pub fn handle(me: &str, from: &Sender, account: &str, args: &[&str], ctx: &mut S
                 return;
             };
             let target = db.resolve_account(nick).map(str::to_string).unwrap_or_else(|| nick.to_string());
+            // Cap the list so it (and the replicated event log) can't grow without
+            // bound — mirrors AJOIN/CERT; unthrottled for identified users otherwise.
+            const MAX_IGNORE: usize = 50;
+            if db.memo_ignores(account).len() >= MAX_IGNORE {
+                ctx.notice(me, from.uid, format!("Your memo-ignore list is full (max {MAX_IGNORE})."));
+                return;
+            }
             if db.memo_ignore_add(account, &target) {
                 ctx.notice(me, from.uid, format!("Now ignoring memos from \x02{target}\x02."));
             } else {

modules/operserv/src/info.rs

@@ -18,6 +18,12 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
 
 // `note` empty clears; otherwise it's the joined note words.
 fn set(me: &str, from: &Sender, target: Option<&str>, note: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
+    // Changing a staff note mutates account/channel data (an operator viewing it is
+    // fine, but not overwriting an administrator's note, e.g. a ban-evader flag).
+    if !from.privs.has(Priv::Admin) {
+        ctx.notice(me, from.uid, "Access denied — changing a staff note needs the \x02admin\x02 privilege.");
+        return;
+    }
     let Some(target) = target else {
         ctx.notice(me, from.uid, "Syntax: INFO ADD <target> <note> | INFO DEL <target>");
         return;