8 files changed, 78 insertions, 12 deletions
diff --git a/src/modules/m_cgiirc.cpp b/src/modules/m_cgiirc.cpp
index cce2e7855..09f6a4659 100644
--- a/src/modules/m_cgiirc.cpp
+++ b/src/modules/m_cgiirc.cpp
@@ -73,6 +73,7 @@ class CommandWebirc : public Command
 		  realhost("cgiirc_realhost", Creator), realip("cgiirc_realip", Creator),
 		  webirc_hostname("cgiirc_webirc_hostname", Creator), webirc_ip("cgiirc_webirc_ip", Creator)
 		{
+			allow_empty_last_param = false;
 			works_before_reg = true;
 			this->syntax = "password client hostname ip";
 		}
@@ -81,6 +82,14 @@ class CommandWebirc : public Command
 			if(user->registered == REG_ALL)
 				return CMD_FAILURE;
 
+			irc::sockets::sockaddrs ipaddr;
+			if (!irc::sockets::aptosa(parameters[3], 0, ipaddr))
+			{
+				IS_LOCAL(user)->CommandFloodPenalty += 5000;
+				ServerInstance->SNO->WriteGlobalSno('a', "Connecting user %s tried to use WEBIRC but gave an invalid IP address.", user->GetFullRealHost().c_str());
+				return CMD_FAILURE;
+			}
+
 			for(CGIHostlist::iterator iter = Hosts.begin(); iter != Hosts.end(); iter++)
 			{
 				if(InspIRCd::Match(user->host, iter->hostmask, ascii_case_insensitive_map) || InspIRCd::MatchCIDR(user->GetIPString(), iter->hostmask, ascii_case_insensitive_map))
@@ -108,6 +117,7 @@ class CommandWebirc : public Command
 				}
 			}
 
+			IS_LOCAL(user)->CommandFloodPenalty += 5000;
 			ServerInstance->SNO->WriteGlobalSno('a', "Connecting user %s tried to use WEBIRC, but didn't match any configured webirc blocks.", user->GetFullRealHost().c_str());
 			return CMD_FAILURE;
 		}
diff --git a/src/modules/m_cloaking.cpp b/src/modules/m_cloaking.cpp
index 1bf99f919..f4cfdb54f 100644
--- a/src/modules/m_cloaking.cpp
+++ b/src/modules/m_cloaking.cpp
@@ -96,6 +96,10 @@ class CloakUser : public ModeHandler
 
 		if (adding)
 		{
+			// assume this is more correct
+			if (user->registered != REG_ALL && user->host != user->dhost)
+				return MODEACTION_DENY;
+
 			std::string* cloak = ext.get(user);
 
 			if (!cloak)
diff --git a/src/modules/m_override.cpp b/src/modules/m_override.cpp
index 3e42c4f79..3266d3eb0 100644
--- a/src/modules/m_override.cpp
+++ b/src/modules/m_override.cpp
@@ -101,7 +101,8 @@ class ModuleOverride : public Module
 		if (IS_OPER(source) && CanOverride(source,"KICK"))
 		{
 			// If the kicker's status is less than the target's,			or	the kicker's status is less than or equal to voice
-			if ((memb->chan->GetPrefixValue(source) < memb->getRank()) || (memb->chan->GetPrefixValue(source) <= VOICE_VALUE))
+			if ((memb->chan->GetPrefixValue(source) < memb->getRank()) || (memb->chan->GetPrefixValue(source) <= VOICE_VALUE) ||
+			    (memb->chan->GetPrefixValue(source) == HALFOP_VALUE && memb->getRank() == HALFOP_VALUE))
 			{
 				ServerInstance->SNO->WriteGlobalSno('v',source->nick+" used oper override to kick "+memb->user->nick+" on "+memb->chan->name+" ("+reason+")");
 				return MOD_RES_ALLOW;
diff --git a/src/modules/m_permchannels.cpp b/src/modules/m_permchannels.cpp
index e86b3cbf6..74a798356 100644
--- a/src/modules/m_permchannels.cpp
+++ b/src/modules/m_permchannels.cpp
@@ -298,6 +298,12 @@ public:
 
 				ServerInstance->Logs->Log("m_permchannels", DEBUG, "Added %s with topic %s", channel.c_str(), topic.c_str());
 
+				if (modes.find('P') == std::string::npos)
+				{
+					ServerInstance->Logs->Log("m_permchannels", DEFAULT, "%s (%s) does not have +P set in <permchannels:modes>; it will be deleted when empty!",
+						c->name.c_str(), tag->getTagLocation().c_str());
+				}
+
 				if (modes.empty())
 					continue;
 
diff --git a/src/modules/m_sakick.cpp b/src/modules/m_sakick.cpp
index 7dfcd8904..afca49e25 100644
--- a/src/modules/m_sakick.cpp
+++ b/src/modules/m_sakick.cpp
@@ -63,14 +63,6 @@ class CommandSakick : public Command
 			if (IS_LOCAL(dest))
 			{
 				channel->KickUser(ServerInstance->FakeClient, dest, reason);
-
-				Channel *n = ServerInstance->FindChan(parameters[1]);
-				if (n && n->HasUser(dest))
-				{
-					/* Sort-of-bug: If the command was issued remotely, this message won't be sent */
-					user->WriteServ("NOTICE %s :*** Unable to kick %s from %s", user->nick.c_str(), dest->nick.c_str(), parameters[0].c_str());
-					return CMD_FAILURE;
-				}
 			}
 
 			if (IS_LOCAL(user))
diff --git a/src/modules/m_sasl.cpp b/src/modules/m_sasl.cpp
index 649c21809..5afab9502 100644
--- a/src/modules/m_sasl.cpp
+++ b/src/modules/m_sasl.cpp
@@ -51,10 +51,63 @@ class SaslAuthenticator
 	SaslResult result;
 	bool state_announced;
 
+	/* taken from m_services_account */
+	static bool ReadCGIIRCExt(const char* extname, User* user, std::string& out)
+	{
+		ExtensionItem* wiext = ServerInstance->Extensions.GetItem(extname);
+		if (!wiext)
+			return false;
+
+		if (wiext->creator->ModuleSourceFile != "m_cgiirc.so")
+			return false;
+
+		StringExtItem* stringext = static_cast<StringExtItem*>(wiext);
+		std::string* addr = stringext->get(user);
+		if (!addr)
+			return false;
+
+		out = *addr;
+		return true;
+	}
+
+
+	void SendHostIP()
+	{
+		std::string host, ip;
+
+		if (!ReadCGIIRCExt("cgiirc_webirc_hostname", user, host))
+		{
+			host = user->host;
+		}
+		if (!ReadCGIIRCExt("cgiirc_webirc_ip", user, ip))
+		{
+			ip = user->GetIPString();
+		}
+		else
+		{
+			/* IP addresses starting with a : on irc are a Bad Thing (tm) */
+			if (ip.c_str()[0] == ':')
+				ip.insert(ip.begin(),1,'0');
+		}
+
+		parameterlist params;
+		params.push_back(sasl_target);
+		params.push_back("SASL");
+		params.push_back(user->uuid);
+		params.push_back("*");
+		params.push_back("H");
+		params.push_back(host);
+		params.push_back(ip);
+
+		SendSASL(params);
+	}
+
  public:
 	SaslAuthenticator(User* user_, const std::string& method)
 		: user(user_), state(SASL_INIT), state_announced(false)
 	{
+		SendHostIP();
+
 		parameterlist params;
 		params.push_back(sasl_target);
 		params.push_back("SASL");
diff --git a/src/users.cpp b/src/users.cpp
index af0e15f65..4dbb73a1f 100644
--- a/src/users.cpp
+++ b/src/users.cpp
@@ -837,6 +837,7 @@ void LocalUser::FullConnect()
 void User::InvalidateCache()
 {
 	/* Invalidate cache */
+	cachedip.clear();
 	cached_fullhost.clear();
 	cached_hostip.clear();
 	cached_makehost.clear();
@@ -1001,8 +1002,7 @@ irc::sockets::cidr_mask User::GetCIDRMask()
 
 bool User::SetClientIP(const char* sip, bool recheck_eline)
 {
-	cachedip.clear();
-	cached_hostip.clear();
+	this->InvalidateCache();
 	return irc::sockets::aptosa(sip, 0, client_sa);
 }
 
diff --git a/src/version.sh b/src/version.sh
index 74a583759..2025a4810 100755
--- a/src/version.sh
+++ b/src/version.sh
@@ -1,2 +1,2 @@
 #!/bin/sh
-echo "InspIRCd-2.0.23"
+echo "InspIRCd-2.0.24"