{"action":"opened","issue":{"url":"https://api.github.com/repos/ngircd/ngircd/issues/176","labels_url":"https://api.github.com/repos/ngircd/ngircd/issues/176/labels{/name}","comments_url":"https://api.github.com/repos/ngircd/ngircd/issues/176/comments","events_url":"https://api.github.com/repos/ngircd/ngircd/issues/176/events","html_url":"https://github.com/ngircd/ngircd/issues/176","id":66705282,"number":176,"title":"ngircd revealing secret channels through /whois command","user":{"login":"alexbarton","id":174961,"avatar_url":"https://avatars.githubusercontent.com/u/174961?v=3","gravatar_id":"","url":"https://api.github.com/users/alexbarton","html_url":"https://github.com/alexbarton","followers_url":"https://api.github.com/users/alexbarton/followers","following_url":"https://api.github.com/users/alexbarton/following{/other_user}","gists_url":"https://api.github.com/users/alexbarton/gists{/gist_id}","starred_url":"https://api.github.com/users/alexbarton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexbarton/subscriptions","organizations_url":"https://api.github.com/users/alexbarton/orgs","repos_url":"https://api.github.com/users/alexbarton/repos","events_url":"https://api.github.com/users/alexbarton/events{/privacy}","received_events_url":"https://api.github.com/users/alexbarton/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ngircd/ngircd/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-04-06T21:03:40Z","updated_at":"2015-04-06T21:03:40Z","closed_at":null,"body":"(Report imported from Bugzilla #176)\n\nStatus CLOSED, severity *major*, in component *Daemon*.\nReported in version *development* on platform *All*.\nAssigned to: Alexander Barton.\n\nOriginal attachment names and IDs:\n- _[0001-fix-bug-secret-channels-exposed-by-whois-command.patch](https://arthur.barton.de/bugzilla//attachment.cgi?id=92)_ (ID 92)\n\nOn 2014-02-11 06:40:36 +0100, Michael Opdenacker wrote:\n\n> Created attachment 92\n> Patch fixing this bug\n> \n> Hi,\n> \n> We are running an IRC server with ngircd for private discussions with our customers. Typically our channels are called \"#customer\".\n> \n> All our channels are \"secret\" because some of our customers are competitors between each other.\n> \n> However, I found that current and older versions of ngircd reveal all channels a user is connected to, through the \"/whois <nick>\" command, even if these are declared as \"secret\".\n> \n> As I am subscribed to all channels, anyone subscribed to at least one channel can then see all our channels, and thanks to our channel naming scheme, see what other customers we work for. That's pretty bad in terms of privacy, and I'm surprised nobody has reported this before.\n> \n> It appears that is caused by a simple mistake in the code.\n> \n> The attached patch fixes this, and was tested successfully.\n> \n> If you wish to fix this in another way, I'll be happy to test it too.\n> \n> Thank you for the nice server!\n> \n> Michael.\n\nOn 2014-02-11 18:37:29 +0100, Florian Westphal wrote:\n\n> Cannot reproduce this.\n> \n> User fw_ running /whois fw:\n> [..]\n> 18:27 -!-  channels : @#bla\n> \n> user fw running /whois fw:\n> [..]\n> 18:28 -!-  channels : @#bla @#secret\n> \n> If fw_ /joins #secret, its shown as expected.\n> \n> The patch makes no sense to me:\n>                 if (Channel_HasMode(chan, 's')\n> -                   && !Channel_IsMemberOf(chan, Client))\n> +                   && Channel_IsMemberOf(chan, Client))\n>                         continue;\n> \n> We want to supress 'continue' the output of the channel name if\n> it is a secret channel AND the requesting client is not a member of that channel.\n> \n> Your patch means that we would now reveal secret channels to people not on that\n> channel.\n\nOn 2014-02-21 20:00:14 +0100, Alexander Barton wrote:\n\n> I can't reproduce this either:\n> \n> As \"SecUser\":\n> \n> whois SecUser\n> :irc.barton.de 311 SecUser SecUser ~secuser silverbird.barton.de * :Secret User\n> :irc.barton.de 312 SecUser SecUser irc.barton.de :Alex' IRC Server, Freiburg\n> :irc.barton.de 319 SecUser SecUser :@#sec3 @#sec2 @#sec1\n> :irc.barton.de 378 SecUser SecUser :is connecting from *@silverbird.barton.de 192.168.91.3\n> :irc.barton.de 379 SecUser SecUser :is using modes +i\n> :irc.barton.de 317 SecUser SecUser 20 1393008739 :seconds idle, signon time\n> :irc.barton.de 318 SecUser SecUser :End of WHOIS list\n> \n> Channels \"#sec1\", \"#sec2\", \"#sec3\" are all set to \"+s\".\n> \n> As \"Tester\":\n> \n> whois Tester\n> :irc.barton.de 311 Tester Tester ~tester silverbird.barton.de * :Test User\n> :irc.barton.de 312 Tester Tester irc.barton.de :Alex' IRC Server, Freiburg\n> :irc.barton.de 378 Tester Tester :is connecting from *@silverbird.barton.de 192.168.91.3\n> :irc.barton.de 379 Tester Tester :is using modes +i\n> :irc.barton.de 317 Tester Tester 9 1393008870 :seconds idle, signon time\n> :irc.barton.de 318 Tester Tester :End of WHOIS list\n> whois SecUser\n> :irc.barton.de 311 Tester SecUser ~secuser silverbird.barton.de * :Secret User\n> :irc.barton.de 312 Tester SecUser irc.barton.de :Alex' IRC Server, Freiburg\n> :irc.barton.de 317 Tester SecUser 130 1393008739 :seconds idle, signon time\n> :irc.barton.de 318 Tester SecUser :End of WHOIS list\n> join #sec2\n> :Tester!~tester@silverbird.barton.de JOIN :#sec2\n> :irc.barton.de 353 Tester = #sec2 :Tester @SecUser\n> :irc.barton.de 366 Tester #sec2 :End of NAMES list\n> whois SecUser\n> :irc.barton.de 311 Tester SecUser ~secuser silverbird.barton.de * :Secret User\n> :irc.barton.de 312 Tester SecUser irc.barton.de :Alex' IRC Server, Freiburg\n> :irc.barton.de 319 Tester SecUser :@#sec2\n> :irc.barton.de 317 Tester SecUser 142 1393008739 :seconds idle, signon time\n> :irc.barton.de 318 Tester SecUser :End of WHOIS list\n> \n> So everything seems to work as expected?\n> \n> And I do agree with Florian, the patch makes no sense at all.\n> \n> Are we missing something?\n> \n> Michael, are you sure your channels are really secret (+s)?\n> What does \"MODE #channel\" show?\n> And can you provide the raw output of the MODE and WHOIS commands?\n> \n> Thanks!\n> Alex\n\nOn 2014-03-18 17:40:51 +0100, Alexander Barton wrote:\n\n> Closing this bug as \"WORKSFORME\" for now.\n> \n> Please provide more information if you think there is a bug.\n> \n> Thanks!\n> Alex\n\nOn 2014-06-04 12:30:16 +0200, Alexander Barton wrote:\n\n> No new information, so closing this bug. Thanks.\n\n"}}