Fix SF#1704419 by properly hiding hidden ports.

[ircu2.10.12-pk.git] / ircd / m_stats.c

diff --git a/ircd/m_stats.c b/ircd/m_stats.c
index 73cfe8196069da8a9be353cf16c20b35b5f4f0bd..c173e833001dc5ffeb5d73c033c9ac262182b05e 100644 (file)
--- a/ircd/m_stats.c
+++ b/ircd/m_stats.c
@@ -121,7 +121,7 @@ m_stats(struct Client* cptr, struct Client* sptr, int parc, char* parv[])
   const struct StatDesc *sd;
   char *param = 0;
 
-  /* If we didn't find a descriptor and this is my client, send them help */
+  /* If we didn't find a descriptor, send them help */
   if ((parc < 2) || !(sd = stats_find(parv[1])))
       parv[1] = "*", sd = stats_find("*");
 
@@ -131,15 +131,14 @@ m_stats(struct Client* cptr, struct Client* sptr, int parc, char* parv[])
    * not privileged (server or an operator), then the STAT_FLAG_OPERONLY
    * flag must not be set, and if the STAT_FLAG_OPERFEAT flag is set,
    * then the feature given by sd->sd_control must be off.
+   *
+   * This checks cptr rather than sptr so that a local oper may send
+   * /stats queries to other servers.
    */
   if (!IsPrivileged(cptr) &&
       ((sd->sd_flags & STAT_FLAG_OPERONLY) ||
        ((sd->sd_flags & STAT_FLAG_OPERFEAT) && feature_bool(sd->sd_control))))
-    return send_reply(cptr, ERR_NOPRIVILEGES);
-
-  /* Check for extra parameter */
-  if ((sd->sd_flags & STAT_FLAG_VARPARAM) && parc > 3 && !EmptyString(parv[3]))
-    param = parv[3];
+    return send_reply(sptr, ERR_NOPRIVILEGES);
 
   /* Ok, track down who's supposed to get this... */
   if (hunt_server_cmd(sptr, CMD_STATS, cptr, feature_int(FEAT_HIS_REMOTE),
@@ -147,6 +146,14 @@ m_stats(struct Client* cptr, struct Client* sptr, int parc, char* parv[])
       HUNTED_ISME)
     return 0; /* Someone else--cool :) */
 
+  /* Check if they are a local user */
+  if ((sd->sd_flags & STAT_FLAG_LOCONLY) && !MyUser(sptr))
+    return send_reply(sptr, ERR_NOPRIVILEGES);
+
+  /* Check for extra parameter */
+  if ((sd->sd_flags & STAT_FLAG_VARPARAM) && parc > 3 && !EmptyString(parv[3]))
+    param = parv[3];
+
   assert(sd->sd_func != 0);
 
   /* Ok, dispatch the stats function */