From 8ed2003546f0603fa60108615e3f0a5db62a8051 Mon Sep 17 00:00:00 2001
From: reverse <mike.chevronnet@gmail.com>
Date: Mon, 17 Aug 2026 14:52:38 +0000
Subject: [PATCH] callerid: scrub a departed/renamed nick from ACCEPT lists so
 it can't be reused to bypass +g

---
 src/server.rs |  6 ++++++
 src/users.rs  | 12 ++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/src/server.rs b/src/server.rs
index ef232d3..a109812 100644
--- a/src/server.rs
+++ b/src/server.rs
@@ -665,6 +665,12 @@ impl Server {
         // socket itself once the channel is empty.
         if !user.nick.is_empty() {
             self.nick_index.remove(&user.nick.to_ascii_lowercase());
+            // Scrub the departed nick from every +g callerid ACCEPT list, so a new
+            // user grabbing this nick can't inherit its acceptance and bypass a gate.
+            let low = user.nick.to_ascii_lowercase();
+            for u in self.users.values_mut() {
+                u.accept.retain(|n| n != &low);
+            }
         }
         if user.registered {
             let line = format!(":{} QUIT :{reason}", user.prefix());
diff --git a/src/users.rs b/src/users.rs
index 83ab587..fa4fad6 100644
--- a/src/users.rs
+++ b/src/users.rs
@@ -460,6 +460,18 @@ impl Server {
             u.nick = newnick.to_string();
             u.nick_ts = crate::server::now();
         }
+        // Keep +g callerid ACCEPT lists in step: move the entry from the old nick to
+        // the new one, so the freed old nick can't be grabbed to bypass someone's gate.
+        let (oldlow, newlow) = (old.to_ascii_lowercase(), newnick.to_ascii_lowercase());
+        if !old.is_empty() && oldlow != newlow {
+            for u in self.users.values_mut() {
+                for n in u.accept.iter_mut() {
+                    if *n == oldlow {
+                        *n = newlow.clone();
+                    }
+                }
+            }
+        }
         if registered {
             let line = format!(":{prefix} NICK :{newnick}");
             let mut targets: HashSet<Uid> = HashSet::new();