{"action":"created","issue":{"url":"https://api.github.com/repos/inspircd/inspircd/issues/1055","labels_url":"https://api.github.com/repos/inspircd/inspircd/issues/1055/labels{/name}","comments_url":"https://api.github.com/repos/inspircd/inspircd/issues/1055/comments","events_url":"https://api.github.com/repos/inspircd/inspircd/issues/1055/events","html_url":"https://github.com/inspircd/inspircd/issues/1055","id":84641449,"number":1055,"title":"+X mode seems dangerous/insecure to me","user":{"login":"webczat","id":1782330,"avatar_url":"https://avatars.githubusercontent.com/u/1782330?v=3","gravatar_id":"","url":"https://api.github.com/users/webczat","html_url":"https://github.com/webczat","followers_url":"https://api.github.com/users/webczat/followers","following_url":"https://api.github.com/users/webczat/following{/other_user}","gists_url":"https://api.github.com/users/webczat/gists{/gist_id}","starred_url":"https://api.github.com/users/webczat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/webczat/subscriptions","organizations_url":"https://api.github.com/users/webczat/orgs","repos_url":"https://api.github.com/users/webczat/repos","events_url":"https://api.github.com/users/webczat/events{/privacy}","received_events_url":"https://api.github.com/users/webczat/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-06-03T16:07:45Z","updated_at":"2015-06-19T21:35:15Z","closed_at":null,"body":"Hello.\r\n\r\nI believe that the +X channel mode (m_exemptchanops) is quite problematic, but I am not sure about the possible directions of fixes, if any.\r\nFirst, the thing is that when someone sets +X with a parameter, the parameter syntax is not checked at all even though I believe it should be, as syntax is modename:prefixchar or similar.\r\nIn addition, there are no permission checks. Like any halfop may set the mode, and unset it. it allows this halfop to enable any exemption he wishes to enable, and for any prefix, liike a halfop can make voices flood protected, and override channel owner decisions if he decided that only owners are protected. It cannot be set in stone/mlocked, because if multiple +X are set for the same exemption, then the last one wins, not the first, so anyone with +h or above can override a mlock."},"comment":{"url":"https://api.github.com/repos/inspircd/inspircd/issues/comments/113650337","html_url":"https://github.com/inspircd/inspircd/issues/1055#issuecomment-113650337","issue_url":"https://api.github.com/repos/inspircd/inspircd/issues/1055","id":113650337,"user":{"login":"SaberUK","id":1565825,"avatar_url":"https://avatars.githubusercontent.com/u/1565825?v=3","gravatar_id":"","url":"https://api.github.com/users/SaberUK","html_url":"https://github.com/SaberUK","followers_url":"https://api.github.com/users/SaberUK/followers","following_url":"https://api.github.com/users/SaberUK/following{/other_user}","gists_url":"https://api.github.com/users/SaberUK/gists{/gist_id}","starred_url":"https://api.github.com/users/SaberUK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SaberUK/subscriptions","organizations_url":"https://api.github.com/users/SaberUK/orgs","repos_url":"https://api.github.com/users/SaberUK/repos","events_url":"https://api.github.com/users/SaberUK/events{/privacy}","received_events_url":"https://api.github.com/users/SaberUK/received_events","type":"User","site_admin":false},"created_at":"2015-06-19T21:35:15Z","updated_at":"2015-06-19T21:35:15Z","body":"@attilamolnar @GLolol I think that locking list modes is something that only Anope can do."}}