diff options
| author | Alexander Barton <alex@barton.de> | 2012-06-01 23:57:51 +0200 |
|---|---|---|
| committer | Alexander Barton <alex@barton.de> | 2012-06-01 23:57:51 +0200 |
| commit | 6680b536c4da7dc27e11490fe098e98cb0393fa2 (patch) | |
| tree | c639dd932980c79809e6de3dc2af7106113e4805 /src | |
| parent | a21a7d8b66bada3c581b7d1fe4279432344f2fd5 (diff) | |
| download | ngircd-6680b536c4da7dc27e11490fe098e98cb0393fa2.tar.gz ngircd-6680b536c4da7dc27e11490fe098e98cb0393fa2.zip | |
USER command: only allow alphanumeric characters in user name
Only alphanumeric characters are allowed in the user name, so terminate the connection if any "strage" characters have been supplied by the user. This is how other IRC daemons (like ircd2.11 and ircd-seven) behave ...
Diffstat (limited to 'src')
| -rw-r--r-- | src/ngircd/irc-login.c | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/src/ngircd/irc-login.c b/src/ngircd/irc-login.c index 6c1c708a..3fb1b902 100644 --- a/src/ngircd/irc-login.c +++ b/src/ngircd/irc-login.c @@ -400,9 +400,7 @@ GLOBAL bool IRC_USER(CLIENT * Client, REQUEST * Req) { CLIENT *c; -#ifdef IDENTAUTH char *ptr; -#endif assert(Client != NULL); assert(Req != NULL); @@ -420,7 +418,19 @@ IRC_USER(CLIENT * Client, REQUEST * Req) Client_ID(Client), Req->command); - /* User name */ + /* User name: only alphanumeric characters are allowed! */ + ptr = Req->argv[0]; + while (*ptr) { + if ((*ptr < '0' || *ptr > '9') && + (*ptr < 'A' || *ptr > 'Z') && + (*ptr < 'a' || *ptr > 'z')) { + Conn_Close(Client_Conn(Client), NULL, + "Invalid user name", true); + return DISCONNECTED; + } + ptr++; + } + #ifdef IDENTAUTH ptr = Client_User(Client); if (!ptr || !*ptr || *ptr == '~') |