From 0a67b8861adfca7b09e59d9639e26b6bf71859a5 Mon Sep 17 00:00:00 2001
From: Sadie Powell <sadie@witchery.services>
Date: Wed, 11 Mar 2020 14:32:46 +0000
Subject: Warn if the server config contains an unhashed password.

This will be made a hard failure in v4.
---
 src/modules/m_cgiirc.cpp      |  9 ++++++++-
 src/modules/m_customtitle.cpp |  8 +++++++-
 src/modules/m_vhost.cpp       | 10 +++++++++-
 3 files changed, 24 insertions(+), 3 deletions(-)

(limited to 'src/modules')

diff --git a/src/modules/m_cgiirc.cpp b/src/modules/m_cgiirc.cpp
index 94fc99db1..d4a02859d 100644
--- a/src/modules/m_cgiirc.cpp
+++ b/src/modules/m_cgiirc.cpp
@@ -307,12 +307,19 @@ class ModuleCgiIRC
 				// The IP address will be received via the WEBIRC command.
 				const std::string fingerprint = tag->getString("fingerprint");
 				const std::string password = tag->getString("password");
+				const std::string passwordhash = tag->getString("hash", "plaintext", 1);
 
 				// WebIRC blocks require a password.
 				if (fingerprint.empty() && password.empty())
 					throw ModuleException("When using <cgihost type=\"webirc\"> either the fingerprint or password field is required, at " + tag->getTagLocation());
 
-				webirchosts.push_back(WebIRCHost(mask, fingerprint, password, tag->getString("hash")));
+				if (!password.empty() && stdalgo::string::equalsci(passwordhash, "plaintext"))
+				{
+					ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "<cgihost> tag at %s contains an plain text password, this is insecure!",
+						tag->getTagLocation().c_str());
+				}
+
+				webirchosts.push_back(WebIRCHost(mask, fingerprint, password, passwordhash));
 			}
 			else
 			{
diff --git a/src/modules/m_customtitle.cpp b/src/modules/m_customtitle.cpp
index faf614e2f..7cdd0bc4f 100644
--- a/src/modules/m_customtitle.cpp
+++ b/src/modules/m_customtitle.cpp
@@ -136,7 +136,13 @@ class ModuleCustomTitle : public Module, public Whois::LineEventListener
 			if (pass.empty())
 				throw ModuleException("<title:password> is empty at " + tag->getTagLocation());
 
-			std::string hash = tag->getString("hash");
+			const std::string hash = tag->getString("hash", "plaintext", 1);
+			if (stdalgo::string::equalsci(hash, "plaintext"))
+			{
+				ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "<title> tag for %s at %s contains an plain text password, this is insecure!",
+					name.c_str(), tag->getTagLocation().c_str());
+			}
+
 			std::string host = tag->getString("host", "*@*");
 			std::string title = tag->getString("title");
 			std::string vhost = tag->getString("vhost");
diff --git a/src/modules/m_vhost.cpp b/src/modules/m_vhost.cpp
index 573b9b31a..43d732ef9 100644
--- a/src/modules/m_vhost.cpp
+++ b/src/modules/m_vhost.cpp
@@ -103,13 +103,21 @@ class ModuleVHost : public Module
 			std::string mask = tag->getString("host");
 			if (mask.empty())
 				throw ModuleException("<vhost:host> is empty! at " + tag->getTagLocation());
+
 			std::string username = tag->getString("user");
 			if (username.empty())
 				throw ModuleException("<vhost:user> is empty! at " + tag->getTagLocation());
+
 			std::string pass = tag->getString("pass");
 			if (pass.empty())
 				throw ModuleException("<vhost:pass> is empty! at " + tag->getTagLocation());
-			std::string hash = tag->getString("hash");
+
+			const std::string hash = tag->getString("hash", "plaintext", 1);
+			if (stdalgo::string::equalsci(hash, "plaintext"))
+			{
+				ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "<vhost> tag for %s at %s contains an plain text password, this is insecure!",
+					username.c_str(), tag->getTagLocation().c_str());
+			}
 
 			CustomVhost vhost(username, pass, hash, mask);
 			newhosts.insert(std::make_pair(username, vhost));
-- 
cgit v1.2.3