reverse d495fd0f30 channel: cap the per-channel invite set (maxinvites, default 100) — it only shrank when the invitee joined, so an op could grow it unboundedly; re-inviting an already-listed nick still works		2026-08-19 01:22:32 +00:00
..
core_channel.rs	channel: cap the per-channel invite set (maxinvites, default 100) — it only shrank when the invitee joined, so an op could grow it unboundedly; re-inviting an already-listed nick still works	2026-08-19 01:22:32 +00:00
core_extra.rs	oper: TLS client-cert fingerprint login — oper block gains an optional fp=<sha256>; password=* means cert-only. Named OperBlock struct replaces the (name,pass,level) tuple. (Password login was never broken — verified live.)	2026-08-18 22:55:07 +00:00
core_info.rs	who: hide +u auditorium and +D delayjoin members on WHO #chan, matching NAMES	2026-08-17 14:52:38 +00:00
core_message.rs	refactor: WEBIRC gateways and +G censor rules are named structs (WebircGateway/CensorRule) instead of positional tuples — self-documenting field access, no (_, g, _) index guessing; extends the OperBlock pattern	2026-08-18 23:31:21 +00:00
core_mode.rs	mode: cap mode changes per MODE command (modes=, default 20) and advertise it as the MODES= ISUPPORT token — an uncapped modestring like MODE #c +bbbb… dispatched a handler per letter, each fanning out to the whole channel and every S2S link (amplification DoS); matches InspIRCd's MODES limit	2026-08-19 00:40:58 +00:00
core_oper.rs	oper: gate the client-facing SVSLOGIN/SVSLOGOUT behind oper_svslogin (default off) — they were a pre-S2S stopgap that let any oper forge an arbitrary account login (set_login) and thus +r/account-gated access; the live path is S2S link_svslogin (source_is_service-gated), so services are unaffected — only the obsolete oper backdoor is closed	2026-08-19 01:01:33 +00:00
core_rehash.rs	operprefix + ojoin: server oper prefix (!/mode y, above owner) auto-granted to opers + OJOIN command	2026-08-10 13:01:07 +00:00
core_user.rs	auth: constant-time compare for VHOST and WEBIRC secrets — both used plain == on the config password, unlike oper/RPC/JWT secrets which already route through ct_eq; expose password_hash::ct_eq as the shared comparator and use it (usernames stay plain == — not secret)	2026-08-19 00:41:47 +00:00
core_watch.rs	operprefix + ojoin: server oper prefix (!/mode y, above owner) auto-granted to opers + OJOIN command	2026-08-10 13:01:07 +00:00
mod.rs	perf: mimalloc global allocator + aHash maps + memchr line framer + LTO/codegen-units=1 — ~29% faster channel fanout; and drop the bogus openssl+mio dependency whitelist from the guard (any perf crate is welcome now)	2026-08-18 19:45:33 +00:00