Use FindNickOnly() in a few more places if a local user is performing an action to prevent UID walking

4 files changed, 25 insertions, 6 deletions

diff --git a/src/modules/m_callerid.cpp b/src/modules/m_callerid.cpp
index 74428f543..09c5c3f24 100644
--- a/src/modules/m_callerid.cpp
+++ b/src/modules/m_callerid.cpp
@@ -197,7 +197,7 @@ public:
 		/* Even if callerid mode is not set, we let them manage their ACCEPT list so that if they go +g they can
 		 * have a list already setup. */
 
-		std::string tok = parameters[0];
+		const std::string& tok = parameters[0];
 
 		if (tok == "*")
 		{
@@ -207,7 +207,12 @@ public:
 		}
 		else if (tok[0] == '-')
 		{
-			User* whotoremove = ServerInstance->FindNick(tok.substr(1));
+			User* whotoremove;
+			if (IS_LOCAL(user))
+				whotoremove = ServerInstance->FindNickOnly(tok.substr(1));
+			else
+				whotoremove = ServerInstance->FindNick(tok.substr(1));
+
 			if (whotoremove)
 				return (RemoveAccept(user, whotoremove) ? CMD_SUCCESS : CMD_FAILURE);
 			else
@@ -215,7 +220,13 @@ public:
 		}
 		else
 		{
-			User* whotoadd = ServerInstance->FindNick(tok[0] == '+' ? tok.substr(1) : tok);
+			const std::string target = (tok[0] == '+' ? tok.substr(1) : tok);
+			User* whotoadd;
+			if (IS_LOCAL(user))
+				whotoadd = ServerInstance->FindNickOnly(target);
+			else
+				whotoadd = ServerInstance->FindNick(target);
+
 			if ((whotoadd) && (whotoadd->registered == REG_ALL) && (!whotoadd->quitting) && (!IS_SERVER(whotoadd)))
 				return (AddAccept(user, whotoadd) ? CMD_SUCCESS : CMD_FAILURE);
 			else
diff --git a/src/modules/m_remove.cpp b/src/modules/m_remove.cpp
index 86f50ad62..cf139f4a3 100644
--- a/src/modules/m_remove.cpp
+++ b/src/modules/m_remove.cpp
@@ -63,7 +63,10 @@ class RemoveBase : public Command
 		const std::string& username = parameters[neworder ? 1 : 0];
 
 		/* Look up the user we're meant to be removing from the channel */
-		target = ServerInstance->FindNick(username);
+		if (IS_LOCAL(user))
+			target = ServerInstance->FindNickOnly(username);
+		else
+			target = ServerInstance->FindNick(username);
 
 		/* And the channel we're meant to be removing them from */
 		channel = ServerInstance->FindChan(channame);
diff --git a/src/modules/m_uninvite.cpp b/src/modules/m_uninvite.cpp
index 10fd7c7b6..ff392edc3 100644
--- a/src/modules/m_uninvite.cpp
+++ b/src/modules/m_uninvite.cpp
@@ -37,7 +37,12 @@ class CommandUninvite : public Command
 
 	CmdResult Handle (const std::vector<std::string> &parameters, User *user)
 	{
-		User* u = ServerInstance->FindNick(parameters[0]);
+		User* u;
+		if (IS_LOCAL(user))
+			u = ServerInstance->FindNickOnly(parameters[0]);
+		else
+			u = ServerInstance->FindNick(parameters[0]);
+
 		Channel* c = ServerInstance->FindChan(parameters[1]);
 
 		if ((!c) || (!u) || (u->registered != REG_ALL))
diff --git a/src/modules/m_userip.cpp b/src/modules/m_userip.cpp
index 5ea84c04a..33b261ca1 100644
--- a/src/modules/m_userip.cpp
+++ b/src/modules/m_userip.cpp
@@ -42,7 +42,7 @@ class CommandUserip : public Command
 
 		for (int i = 0; i < (int)parameters.size(); i++)
 		{
-			User *u = ServerInstance->FindNick(parameters[i]);
+			User *u = ServerInstance->FindNickOnly(parameters[i]);
 			if ((u) && (u->registered == REG_ALL))
 			{
 				// Anyone may query their own IP