fedserv/echo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix duration overflow, expiry-warned resets, DICT control-char injection, and HostServ TAKE forbid recheck

Browse source
This commit is contained in:
Jean Chevronnet 2026-07-19 13:24:46 +00:00
parent 68df1e7078
commit d833dc28f0
No known key found for this signature in database
5 changed files with 20 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
modules/hostserv/src/take.rs
View file

@ -21,6 +21,12 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
return;
}
};
// A menu offer can outlive a later FORBID; re-check at grant time like the
// request/approve/default paths, or a stale offer bypasses the impersonation guard.
if db.vhost_is_forbidden(&host) {
ctx.notice(me, from.uid, format!("\x02{host}\x02 isn't allowed here. Please choose another."));
return;
}
match db.set_vhost(account, &host, "offer", None) {
Ok(()) => {
ctx.apply_vhost(from.uid, &host);