X-Git-Url: https://jfr.im/git/solanum.git/blobdiff_plain/9e6c36d5711e062ad62f7302e7b84f140685b3d6..9dd128b4da6e54ca9f97cfcd48e345a57790ffbe:/extensions/m_webirc.c

diff --git a/extensions/m_webirc.c b/extensions/m_webirc.c
index 318b571b..2937189e 100644
--- a/extensions/m_webirc.c
+++ b/extensions/m_webirc.c
@@ -66,7 +66,8 @@ mapi_clist_av1 webirc_clist[] = { &webirc_msgtab, NULL };
 
 static void new_local_user(void *data);
 mapi_hfn_list_av1 webirc_hfnlist[] = {
-	{ "new_local_user", (hookfn) new_local_user },
+	/* unintuitive but correct--we want to be called first */
+	{ "new_local_user", (hookfn) new_local_user, HOOK_LOWEST },
 	{ NULL, NULL }
 };
 
@@ -86,6 +87,8 @@ mr_webirc(struct MsgBuf *msgbuf_p, struct Client *client_p, struct Client *sourc
 	const char *encr;
 	struct rb_sockaddr_storage addr;
 
+	int secure = 0;
+
 	aconf = find_address_conf(client_p->host, client_p->sockhost,
 				IsGotId(client_p) ? client_p->username : "webirc",
 				IsGotId(client_p) ? client_p->username : "webirc",
@@ -104,6 +107,11 @@ mr_webirc(struct MsgBuf *msgbuf_p, struct Client *client_p, struct Client *sourc
 		sendto_one(source_p, "NOTICE * :CGI:IRC auth blocks must have a password");
 		return;
 	}
+	if (!IsSSL(source_p) && aconf->flags & CONF_FLAGS_NEED_SSL)
+	{
+		sendto_one(source_p, "NOTICE * :Your CGI:IRC block requires TLS");
+		return;
+	}
 
 	if (EmptyString(parv[1]))
 		encr = "";
@@ -126,6 +134,27 @@ mr_webirc(struct MsgBuf *msgbuf_p, struct Client *client_p, struct Client *sourc
 
 	source_p->localClient->ip = addr;
 
+	if (parc >= 6)
+	{
+		const char *s;
+		for (s = parv[5]; s != NULL; (s = strchr(s, ' ')) && s++)
+		{
+			if (!ircncmp(s, "secure", 6) && (s[6] == '=' || s[6] == ' ' || s[6] == '\0'))
+				secure = 1;
+		}
+	}
+
+	if (secure && !IsSSL(source_p))
+	{
+		sendto_one(source_p, "NOTICE * :CGI:IRC is not connected securely; marking you as insecure");
+		secure = 0;
+	}
+
+	if (!secure)
+	{
+		SetInsecure(source_p);
+	}
+
 	rb_inet_ntop_sock((struct sockaddr *)&source_p->localClient->ip, source_p->sockhost, sizeof(source_p->sockhost));
 
 	if(strlen(parv[3]) <= HOSTLEN)