Upstream

.appveyor.yml

@@ -18,7 +18,7 @@ install:
 build_script:
     - git submodule update --init
     - mkdir build
-    - c:\cygwin-root\bin\sh -lc "cd $APPVEYOR_BUILD_FOLDER/build; ../configure --enable-charset --enable-zlib --enable-openssl --enable-perl --enable-python --enable-cyrus --enable-argon < /dev/null; result=$?; cmake --system-information > config.log; appveyor PushArtifact config.log; exit $result"
+    - c:\cygwin-root\bin\sh -lc "cd $APPVEYOR_BUILD_FOLDER/build; env ZNC_QT_VER=5 ../configure --enable-charset --enable-zlib --enable-openssl --enable-perl --enable-python --enable-cyrus --enable-argon < /dev/null; result=$?; cmake --system-information > config.log; appveyor PushArtifact config.log; exit $result"
     - c:\cygwin-root\bin\sh -lc "cd $APPVEYOR_BUILD_FOLDER/build; make VERBOSE=1 -j2 < /dev/null"
     - c:\cygwin-root\bin\sh -lc "cd $APPVEYOR_BUILD_FOLDER/build; make install < /dev/null"
     - c:\cygwin-root\bin\sh -lc "znc --version"
@@ -27,4 +27,4 @@ build_script:
     - c:\cygwin-root\bin\sh -lc "rebase -s -v $(cat /tmp/files-to-rebase)"
 test_script:
     - c:\cygwin-root\bin\sh -lc "cd $APPVEYOR_BUILD_FOLDER/build; make VERBOSE=1 unittest < /dev/null"
-    - c:\cygwin-root\bin\sh -lc "cd $APPVEYOR_BUILD_FOLDER/build; make VERBOSE=1 inttest < /dev/null"
+    - c:\cygwin-root\bin\sh -lc "cd $APPVEYOR_BUILD_FOLDER/build; env ZNC_QT_VER=5 make VERBOSE=1 inttest < /dev/null"

.ci/Jenkinsfile.crowdin

@@ -22,7 +22,8 @@ timestamps {
         step([$class: 'WsCleanup'])
       }
       def tasks = [:]
-      def crowdin_cli = "java -jar ${tool 'crowdin-cli'}/crowdin-cli.jar --config .ci/crowdin.yml"
+      def crowdin_cli = "java -jar ${tool 'crowdin-cli'}/crowdin-cli.jar"
+      def crowdin_cli_suffix = "--config .ci/crowdin.yml"
       for (def branch in branches) {
         def upstream_branch = branch
         def my_branch = "l10n_${branch}"
@@ -43,18 +44,16 @@ timestamps {
               stage("Crowdin for ${upstream_branch}") {
                 withCredentials([string(credentialsId: '11c7e2b4-f990-4670-98a4-c89d2a5a2f43', variable: 'CROWDIN_API_KEY')]) {
                   withEnv(['CROWDIN_BASE_PATH='+pwd()]) {
-                    sh "$crowdin_cli upload sources --branch ${upstream_branch}"
-                    // sh "$crowdin_cli upload translations --branch ${upstream_branch}"
-                    sh "$crowdin_cli download --branch ${upstream_branch}"
+                    sh "$crowdin_cli upload sources --branch ${upstream_branch} ${crowdin_cli_suffix}"
+                    // sh "$crowdin_cli upload translations --branch ${upstream_branch} ${crowdin_cli_suffix}"
+                    sh "$crowdin_cli download --branch ${upstream_branch} ${crowdin_cli_suffix}"
                   }
-                }
-                sh 'LANG=C.UTF-8 find . -name "*.po" -exec msgfilter -i "{}" -o "{}.replacement" .ci/cleanup-po.pl ";"'
-                sh 'find . -name "*.po" -exec mv "{}.replacement" "{}" ";"'
-                withCredentials([string(credentialsId: 'fe727e3e-a8e0-4019-817f-6583c3c51ef7', variable: 'CROWDIN_API2_KEY')]) {
-                  def headers = [[maskValue: true, name: 'Authorization', value: "Bearer ${env.CROWDIN_API2_KEY}"], [maskValue: false, name: 'User-Agent', value: 'https://github.com/znc/znc/blob/master/.ci/Jenkinsfile.crowdin']]
+                  def headers = [[maskValue: true, name: 'Authorization', value: "Bearer ${env.CROWDIN_API_KEY}"], [maskValue: false, name: 'User-Agent', value: 'https://github.com/znc/znc/blob/master/.ci/Jenkinsfile.crowdin']]
                   def contributors = httpRequest consoleLogResponseBody: true, customHeaders: headers, url: "https://crowdin.com/api/v2/projects/289533/members?limit=500"
                   writeFile file: 'contributors.tmp', text: contributors.content
                 }
+                sh 'LANG=C.UTF-8 find . -name "*.po" -exec msgfilter -i "{}" -o "{}.replacement" .ci/cleanup-po.pl ";"'
+                sh 'find . -name "*.po" -exec mv "{}.replacement" "{}" ";"'
                 sh '.ci/crowdin-contributors.py < contributors.tmp'
                 sh 'rm contributors.tmp'
               }
@@ -74,17 +73,18 @@ timestamps {
                   echo 'No changes found'
                   return
                 }
-                sh "git remote add my git@github.com:${my_user}/${my_repo}.git"
                 if (!pr_mode) {
                   sshagent(credentials: ['baf2df74-935d-40e5-b20f-076e92fa3e9f']) {
                     sh "git push upstream HEAD:refs/heads/${upstream_branch}"
                   }
                   return
                 }
+                // Create pull request if it doesn't exist yet
+                // Note: the following code hasn't been executed for long time, so probably nothing here works anymore, APIs might have changed, etc.
+                sh "git remote add my git@github.com:${my_user}/${my_repo}.git"
                 sshagent(credentials: ['6ef10f80-20dc-4661-af45-52a6e1e15749']) {
                   sh "git push my HEAD:refs/heads/${my_branch} -f"
                 }
-                // Create pull request if it doesn't exist yet
                 withCredentials([string(credentialsId: '7a2546ae-8a29-4eab-921c-6a4803456dce', variable: 'GITHUB_OAUTH_KEY')]) {
                   def headers = [[maskValue: true, name: 'Authorization', value: "token ${env.GITHUB_OAUTH_KEY}"], [maskValue: false, name: 'Accept', value: 'application/vnd.github.v3+json'], [maskValue: false, name: 'User-Agent', value: 'https://github.com/znc/znc/blob/master/.ci/Jenkinsfile.crowdin']]
                   def pulls = httpRequest consoleLogResponseBody: true, customHeaders: headers, url: "https://api.github.com/repos/${upstream_user}/${upstream_repo}/pulls?head=${my_user}:${my_branch}&base=${upstream_branch}"

.ci/crowdin.yml

@@ -1,6 +1,7 @@
-project_identifier: znc-bouncer
+# https://crowdin.com/project/znc-bouncer
+project_id: 289533
 preserve_hierarchy: true
-api_key_env: CROWDIN_API_KEY
+api_token_env: CROWDIN_API_KEY
 base_path_env: CROWDIN_BASE_PATH
 
 files:

.github/build.sh

@@ -6,7 +6,7 @@ ls -la
 cpanm --local-lib=~/perl5 local::lib
 eval $(perl -I ~/perl5/lib/perl5/ -Mlocal::lib)
 cpanm --notest Devel::Cover::Report::Clover
-pip3 install --user coverage
+pip3 install --user --break-system-packages coverage
 export ZNC_MODPERL_COVERAGE=1
 #export ZNC_MODPYTHON_COVERAGE=1
 
@@ -39,7 +39,7 @@ ls -lRa
 
 case "${CC:-gcc}" in
 	gcc)
-		lcov --directory . --capture --output-file lcov-coverage.txt
+		lcov --directory . --capture --output-file lcov-coverage.txt --ignore-errors mismatch
 		lcov --list lcov-coverage.txt
 		;;
 	clang)

.github/ubuntu_deps.sh

@@ -1,4 +1,4 @@
 sudo apt-get update
-sudo apt-get install -y tcl-dev libsasl2-dev libicu-dev swig qtbase5-dev libboost-locale-dev libperl-dev libargon2-dev cpanminus gettext clang llvm lcov
+sudo apt-get install -y tcl-dev libsasl2-dev libicu-dev swig qt6-base-dev libboost-locale-dev libperl-dev libargon2-dev cpanminus gettext clang llvm lcov
 sudo apt-get upgrade -y
 

.github/workflows/build.yml

@@ -6,24 +6,24 @@ on:
 jobs:
   gcc:
     name: GCC
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
         with:
           submodules: true
       - run: source .github/ubuntu_deps.sh
       - run: source .github/build.sh
-      - uses: codecov/codecov-action@v3
+      - uses: codecov/codecov-action@v5
         with:
           name: ${{ github.job }}
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
           name: codecov debug results ${{ github.job }}
           path: "/tmp/codecov.*.gz"
 
   tarball:
     name: Tarball
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
         with:
@@ -36,19 +36,19 @@ jobs:
           cd znc-git-$date
           export CFGFLAGS="--with-gtest=$GITHUB_WORKSPACE/third_party/googletest/googletest --with-gmock=$GITHUB_WORKSPACE/third_party/googletest/googlemock --disable-swig"
           source $GITHUB_WORKSPACE/.github/build.sh
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
           name: znc-tarball
           path: /tmp/znc-git*.tar.gz
           if-no-files-found: error
-      - uses: codecov/codecov-action@v3
+      - uses: codecov/codecov-action@v5
         with:
           name: ${{ github.job }}
 
   # can be removed when asan below is fixed
   clang:
     name: Clang
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     env:
       CXX: clang++
       CC: clang
@@ -58,18 +58,18 @@ jobs:
           submodules: true
       - run: source .github/ubuntu_deps.sh
       - run: source .github/build.sh
-      - uses: codecov/codecov-action@v3
+      - uses: codecov/codecov-action@v5
         with:
           name: ${{ github.job }}
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
           name: codecov debug results ${{ github.job }}
           path: "/tmp/codecov.*.gz"
 
 
   #clang_asan:
     #name: Clang ASAN
-    #runs-on: ubuntu-20.04
+    #runs-on: ubuntu-24.04
     #env:
       #CXX: clang++
       #CC: clang
@@ -81,11 +81,11 @@ jobs:
           #submodules: true
       #- run: source .github/ubuntu_deps.sh
       #- run: source .github/build.sh
-      #- uses: codecov/codecov-action@v3
+      #- uses: codecov/codecov-action@v5
 
   #clang_tsan:
     #name: Clang TSAN
-    #runs-on: ubuntu-20.04
+    #runs-on: ubuntu-24.04
     #env:
       #CXX: clang++
       #CC: clang
@@ -97,7 +97,7 @@ jobs:
           #submodules: true
       #- run: source .github/ubuntu_deps.sh
       #- run: source .github/build.sh
-      #- uses: codecov/codecov-action@v3
+      #- uses: codecov/codecov-action@v5
 
       # TODO: enable
       #CXXFLAGS: "-fsanitize=memory -O1 -fno-omit-frame-pointer -fno-optimize-sibling-calls -fsanitize-memory-track-origins"
@@ -119,9 +119,12 @@ jobs:
           submodules: true
       - run: |
           brew update
-          brew install icu4c qt5 gettext pkg-config cpanminus boost
+          brew install icu4c qt6 gettext pkg-config cpanminus boost argon2 swig
       - run: source .github/build.sh
-      - uses: codecov/codecov-action@v3
+        env:
+          # https://github.com/znc/znc/issues/1937
+          GTEST_FILTER: "-*Modpython*:LanguagesTests/AllLanguages.ServerDependentCapInModule/1"
+      - uses: codecov/codecov-action@v5
 
   docker:
     name: Docker push
@@ -156,7 +159,7 @@ jobs:
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
-      - uses: docker/build-push-action@v5
+      - uses: docker/build-push-action@v6
         with:
           context: .
           push: ${{ github.repository == 'znc/znc' && github.event_name == 'push' }}

.github/workflows/cifuzz.yml

@@ -20,7 +20,7 @@ jobs:
         dry-run: false
         language: c++
     - name: Upload Crash
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       if: failure() && steps.build.outcome == 'success'
       with:
         name: artifacts

.github/workflows/codeql.yml

@@ -2,7 +2,7 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ 'master', '1.6.x' ]
+    branches: [ 'master', '1.9.x' ]
   pull_request:
     # The branches below must be a subset of the branches above
     branches: [ 'master' ]
@@ -12,7 +12,7 @@ on:
 jobs:
   analyze:
     name: Analyze
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     permissions:
       actions: read
       contents: read
@@ -28,14 +28,19 @@ jobs:
       uses: actions/checkout@v4
       with:
         submodules: true
-    - run: source .github/ubuntu_deps.sh
+    - run: |
+        source .github/ubuntu_deps.sh
+        sudo apt-get remove -y qt6-base-dev
+        sudo apt-get install -y qtbase5-dev
 
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
 
     - run: source .github/build.sh
+      env:
+        ZNC_QT_VER: "5"
 
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@v3

CMakeLists.txt

@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2004-2024 ZNC, see the NOTICE file for details.
+# Copyright (C) 2004-2025 ZNC, see the NOTICE file for details.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -55,6 +55,7 @@ include(use_homebrew)
 include(GNUInstallDirs)
 include(CheckCXXSymbolExists)
 include(copy_csocket)
+include(CMakePushCheckState)
 
 set(CMAKE_THREAD_PREFER_PTHREAD true)
 set(THREADS_PREFER_PTHREAD_FLAG true)
@@ -89,13 +90,12 @@ if(WANT_OPENSSL)
 		# LibreSSL gained that function later too.
 		# TODO: maybe remove this check at some point, and stop supporting old
 		# libssl versions
-		function(check_SSL_SESSION_get0_cipher)
+		cmake_push_check_state(RESET)
 			set(CMAKE_REQUIRED_LIBRARIES ${OPENSSL_LIBRARIES})
 			set(CMAKE_REQUIRED_INCLUDES ${OPENSSL_INCLUDE_DIR})
 			check_cxx_symbol_exists(SSL_SESSION_get0_cipher openssl/ssl.h
 				HAVE_SSL_SESSION_get0_cipher)
-		endfunction()
-		check_SSL_SESSION_get0_cipher()
+		cmake_pop_check_state()
 		set(ZNC_CMAKE_FIND_DEPS
 			"${ZNC_CMAKE_FIND_DEPS}\nfind_dependency(OpenSSL)")
 		list(APPEND zncpubdeps OpenSSL::SSL)
@@ -120,15 +120,15 @@ if(WANT_CYRUS)
 		# next ubuntu version has 2.1.26 which has libsasl2.pc
 		#
 		# osx (as of El Capitan) doesn't have it either...
-		set(_old_cmake_required_libraries "${CMAKE_REQUIRED_LIBRARIES}")
-		set(CMAKE_REQUIRED_LIBRARIES ${CMAKE_REQUIRED_LIBRARIES} -lsasl2)
-		# sys/types.h here is workaround for sasl 2.1.26:
-		# https://github.com/znc/znc/issues/1243
-		# https://lists.andrew.cmu.edu/pipermail/cyrus-sasl/2012-December/002572.html
-		# https://cgit.cyrus.foundation/cyrus-sasl/commit/include/sasl.h?id=2f740223fa1820dd71e6ab0e50d4964760789209
-		check_cxx_symbol_exists(sasl_server_init "sys/types.h;sasl/sasl.h"
-			CYRUS_HARDCODED)
-		set(CMAKE_REQUIRED_LIBRARIES "${_old_cmake_required_libraries}")
+		cmake_push_check_state(RESET)
+			set(CMAKE_REQUIRED_LIBRARIES -lsasl2)
+			# sys/types.h here is workaround for sasl 2.1.26:
+			# https://github.com/znc/znc/issues/1243
+			# https://lists.andrew.cmu.edu/pipermail/cyrus-sasl/2012-December/002572.html
+			# https://cgit.cyrus.foundation/cyrus-sasl/commit/include/sasl.h?id=2f740223fa1820dd71e6ab0e50d4964760789209
+			check_cxx_symbol_exists(sasl_server_init "sys/types.h;sasl/sasl.h"
+				CYRUS_HARDCODED)
+		cmake_pop_check_state()
 		if(CYRUS_HARDCODED)
 			add_library(HardcodedCyrusDep INTERFACE)
 			add_library(PkgConfig::CYRUS ALIAS HardcodedCyrusDep)
@@ -318,6 +318,8 @@ check_cxx_symbol_exists(lstat "sys/types.h;sys/stat.h;unistd.h" HAVE_LSTAT)
 check_cxx_symbol_exists(getpassphrase "stdlib.h" HAVE_GETPASSPHRASE)
 check_cxx_symbol_exists(tcsetattr "termios.h;unistd.h" HAVE_TCSETATTR)
 check_cxx_symbol_exists(clock_gettime "time.h" HAVE_CLOCK_GETTIME)
+check_cxx_symbol_exists(gethostname "unistd.h" ZNC_HAVE_GETHOSTNAME)
+check_cxx_symbol_exists(uname "sys/utsname.h" ZNC_HAVE_UNAME)
 
 # Note that old broken systems, such as OpenBSD, NetBSD, which don't support
 # AI_ADDRCONFIG, also have thread-unsafe getaddrinfo(). Gladly, they fixed

ChangeLog.md

@@ -1,3 +1,11 @@
+# ZNC 1.9.1 (2024-07-03)
+
+* This is a security release to fix CVE-2024-39844: remote code execution vulnerability in modtcl.
+    * To mitigate this for existing installations, simply unload the modtcl module for every user, if it's loaded. Note that only users with admin rights can load modtcl at all.
+    * Thanks to Johannes Kuhn (DasBrain) for reporting, to glguy for the patch, and to multiple IRC network operators for help with mitigating this on server side before disclosure.
+* Improve tooltips in webadmin.
+
+
 # ZNC 1.9.0 (2024-02-22)
 
 ## New

Dockerfile

@@ -46,7 +46,7 @@ RUN apk add --no-cache --virtual build-dependencies \
     && cd / && rm -rf /znc-src
 
 COPY docker/slim/entrypoint.sh /
-COPY docker/*/??-*.sh /startup-sequence/
+COPY docker/*/??-*.sh docker/*/startup-sequence/??-*.sh /startup-sequence/
 
 VOLUME /znc-data
 

Jenkinsfile

@@ -2,7 +2,8 @@
 
 timestamps {
   node('freebsd') {
-    // freebsd 13.1 + pkg install git openjdk17 cmake icu pkgconf swig python3 boost-libs gettext-tools qt5-buildtools qt5-network qt5-qmake
+    // AWS EC2 AMI: FreeBSD 14.1-STABLE-amd64-20241003 UEFI-PREFERRED base UFS
+    // pkg install git openjdk22 cmake icu pkgconf swig python3 boost-libs gettext-tools qt6-base libargon2
     // Then fill known_hosts with https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints
     // (needed for crowdin cron job in jenkins)
     timeout(time: 30, unit: 'MINUTES') {
@@ -14,7 +15,7 @@ timestamps {
       }
       dir("$wsdir/build") {
         stage('Build') {
-          sh "cmake $wsdir -DWANT_PERL=ON -DWANT_PYTHON=ON -DCMAKE_INSTALL_PREFIX=$wsdir/build/install-prefix"
+          sh "cmake $wsdir -DWANT_PERL=ON -DWANT_PYTHON=ON -DWANT_ARGON=ON -DCMAKE_INSTALL_PREFIX=$wsdir/build/install-prefix"
           sh 'make VERBOSE=1 all'
         }
         stage('Unit test') {

TRANSLATORS.md

@@ -9,17 +9,20 @@ These people helped translating ZNC to various languages:
 * ChaosEngine (Andrzej Pauli)
 * cirinho (Ciro Moniz)
 * CJSStryker
+* Danit
 * DarthGandalf
 * dgw
 * Dreiundachzig
 * Dremski
 * eggoez (Baguz Ach)
+* eleanorsilly (ellie is not coding in the slightest)
 * freonesuka (Андрей Вальтер)
 * gremax
 * hypech
 * JakaMedia (Jaka Media Teknologi)
 * Jay2k1
 * kloun (Victor Kukshiev)
+* kumanoff
 * leon-th (Leon T.)
 * LiteHell
 * lorenzosu