KICK: Fix denial of service bug

[ngircd.git] / src / ngircd / channel.c

diff --git a/src/ngircd/channel.c b/src/ngircd/channel.c
index f3c74dc651f10abf72aab2d0ce5856da8a5e6c5e..b7c35709d3bbdb84122c002cf4e30218c5f5c4d4 100644 (file)
--- a/src/ngircd/channel.c
+++ b/src/ngircd/channel.c
@@ -326,6 +326,13 @@ Channel_Kick(CLIENT *Peer, CLIENT *Target, CLIENT *Origin, const char *Name,
                }
        }
 
+       /* Check that the client to be kicked is on the specified channel */
+       if (!Channel_IsMemberOf(chan, Target)) {
+               IRC_WriteStrClient(Origin, ERR_USERNOTINCHANNEL_MSG,
+                                  Client_ID(Origin), Client_ID(Target), Name );
+               return;
+       }
+
        if(Client_Type(Peer) == CLIENT_USER) {
                /* Channel mode 'Q' and user mode 'q' on target: nobody but
                 * IRC Operators and servers can kick the target user */
@@ -382,13 +389,6 @@ Channel_Kick(CLIENT *Peer, CLIENT *Target, CLIENT *Origin, const char *Name,
                }
        }
 
-       /* Check that the client to be kicked is on the specified channel */
-       if (!Channel_IsMemberOf(chan, Target)) {
-               IRC_WriteStrClient(Origin, ERR_USERNOTINCHANNEL_MSG,
-                                  Client_ID(Origin), Client_ID(Target), Name );
-               return;
-       }
-
        /* Kick Client from channel */
        Remove_Client( REMOVE_KICK, chan, Target, Origin, Reason, true);
 } /* Channel_Kick */
@@ -918,7 +918,11 @@ Channel_Write(CHANNEL *Chan, CLIENT *From, CLIENT *Client, const char *Command,
        if (!Can_Send_To_Channel(Chan, From)) {
                if (! SendErrors)
                        return CONNECTED;       /* no error, see RFC 2812 */
-               return IRC_WriteStrClient(From, ERR_CANNOTSENDTOCHAN_MSG,
+               if (strchr(Channel_Modes(Chan), 'M'))
+                       return IRC_WriteStrClient(From, ERR_NEEDREGGEDNICK_MSG,
+                                                 Client_ID(From), Channel_Name(Chan));
+               else
+                       return IRC_WriteStrClient(From, ERR_CANNOTSENDTOCHAN_MSG,
                                          Client_ID(From), Channel_Name(Chan));
        }