sneak 1ef44fd760 Refuse passwords over 72 bytes and confirm only stored ones (closes #144) ...

bcrypt cannot hash a password longer than 72 bytes. PASS over the HTTP
API answered one with a 500, and the IRC listener confirmed it without
storing it.

Both transports now refuse a password outside 8 to 72 bytes with the
reply a short one already got: 461 over the HTTP API, a NOTICE over the
IRC listener. setPassword returns its error, and "Password set" is sent
only when the password was stored. A PASS given before registration is
checked after the welcome burst and gets the same NOTICE.

Model: opus-5-5

2026-10-21 01:47:04 +00:00

..

api_test.go

Refuse passwords over 72 bytes and confirm only stored ones (closes #144)

2026-10-21 01:47:04 +00:00

api.go

Broadcast a session's QUIT once when its clients leave together (closes #154)

2026-10-21 01:48:26 +02:00

auth.go

Refuse passwords over 72 bytes and confirm only stored ones (closes #144)

2026-10-21 01:47:04 +00:00

handlers.go

Enforce channel keys, invites, +s and +H on the IRC listener (closes #122)

2026-10-20 16:02:14 +02:00

healthcheck.go

feat: add runtime statistics to healthcheck endpoint (#80)

2026-03-17 12:43:39 +01:00

utility_test.go

Compare nicks by exact case everywhere (closes #128)

2026-10-20 16:31:28 +02:00

utility.go

Compare nicks by exact case everywhere (closes #128)

2026-10-20 16:31:28 +02:00