fedserv/echoIRCd
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

core: fire on_user_quit for unregistered users too — pre-registration module state (captcha Challenged/Verified) leaked one Uid per held-then-dropped bot

Browse source
This commit is contained in:
Jean Chevronnet 2026-08-17 21:37:18 +00:00
parent f2e23fffa9
commit 0da0906dc9
1 changed files with 7 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/ircd.rs
View file

@ -623,12 +623,13 @@ impl Ircd {
if !self.server.users.contains_key(&uid) { if !self.server.users.contains_key(&uid) {
return; return;
} }
let registered = self.server.users[&uid].registered; // Fire the quit hook while the user still exists — for EVERY user, registered
if registered { // or not. A client that disconnects mid-registration (e.g. a captcha bot held
// fire the quit hook while the user still exists // before registration) still has per-uid module state to reclaim, and Uids are
for m in &mut self.modules { // never reused, so skipping this leaks one entry per such disconnect (which
m.on_user_quit(&mut self.server, uid, reason); // scales with exactly the hostile traffic the captcha/challenge modules target).
} for m in &mut self.modules {
m.on_user_quit(&mut self.server, uid, reason);
} }
self.server.remove_user(uid, reason); self.server.remove_user(uid, reason);
} }