fedserv/echoIRCd
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

core: fire on_user_quit for unregistered users too — pre-registration module state (captcha Challenged/Verified) leaked one Uid per held-then-dropped bot

Browse source
This commit is contained in:
Jean Chevronnet 2026-08-17 21:37:18 +00:00
parent f2e23fffa9
commit 0da0906dc9
1 changed files with 7 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/ircd.rs
View file

@ -623,12 +623,13 @@ impl Ircd {
if !self.server.users.contains_key(&uid) {
return;
}
let registered = self.server.users[&uid].registered;
if registered {
// fire the quit hook while the user still exists
for m in &mut self.modules {
m.on_user_quit(&mut self.server, uid, reason);
}
// Fire the quit hook while the user still exists — for EVERY user, registered
// or not. A client that disconnects mid-registration (e.g. a captcha bot held
// before registration) still has per-uid module state to reclaim, and Uids are
// never reused, so skipping this leaks one entry per such disconnect (which
// scales with exactly the hostile traffic the captcha/challenge modules target).
for m in &mut self.modules {
m.on_user_quit(&mut self.server, uid, reason);
}
self.server.remove_user(uid, reason);
}