fedserv/echo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

HostServ: re-check the forbidden list when activating a vhost request

Browse source 
REQUEST rejected a forbidden host, but ACTIVATE never re-checked, so a
pattern forbidden after a request was filed was granted on approval. The
activate path now re-reads the forbidden list. Operator SET stays an
intentional override (unchanged), so the check lives in approve, not the
shared prepare_vhost.
This commit is contained in:
Jean Chevronnet 2026-07-16 03:25:27 +00:00
parent b749cd2969
commit dabb18abd4
No known key found for this signature in database
2 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
modules/hostserv/src/approve.rs
View file

@ -34,6 +34,12 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net:
return;
}
};
// The forbidden list may have grown since the request was filed; a user's
// request must still obey it (an operator's own SET is a deliberate override).
if db.vhost_is_forbidden(&host) {
ctx.notice(me, from.uid, format!("Can't activate: \x02{host}\x02 is on the forbidden list."));
return;
}
match db.set_vhost(account, &host, from.nick, None) {
Ok(()) => {
for uid in net.uids_logged_into(account) {