This was reported back in April 2021, thanks Sarah!
Subject: NGIRCD bug report
Date: April 28 2021, 14:30:08 MESZ
To: alex@barton.de
Hello,
I am writing to you to report a bug in ngircd.
In any give channel, if an user is with mode +a (admin), he/she can
sets mode +/-q(owner) to any other user. This is not inline with the
documentation.
I've looked into the code irc-mode.c, apparently an if block is
missing. Below are the code snippets that I believe fixes the bug.
This patch is what Sarah sent in. Thanks a lot!
break;
/* --- Channel user modes --- */
case 'q': /* Owner */
+ if(!is_oper && !is_machine && !is_owner) {
+ connected = IRC_WriteErrClient(Origin,
+ ERR_CHANOPPRIVTOOLOW_MSG,
+ Client_ID(Origin),
+ Channel_Name(Channel));
+ goto chan_exit;
+ }
case 'a': /* Channel admin */
if(!is_oper && !is_machine && !is_owner && !is_admin) {
connected = IRC_WriteErrClient(Origin,