sneak fba2ab960e Refuse passwords over 72 bytes and confirm only stored ones (closes #144) ...

bcrypt cannot hash a password longer than 72 bytes. PASS over the HTTP
API answered one with a 500, and the IRC listener confirmed it without
storing it.

Both transports now refuse a password outside 8 to 72 bytes with the
reply a short one already got: 461 over the HTTP API, a NOTICE over the
IRC listener. setPassword returns its error, and "Password set" is sent
only when the password was stored. A PASS given before registration, an
empty one included, is checked after the welcome burst and gets the
same NOTICE.

Model: opus-5-5

2026-10-21 02:27:16 +00:00

..

api_test.go

Refuse passwords over 72 bytes and confirm only stored ones (closes #144)

2026-10-21 02:27:16 +00:00

api.go

Spend a hashcash stamp only when the request succeeds (closes #158)

2026-10-21 04:02:06 +02:00

auth.go

Refuse passwords over 72 bytes and confirm only stored ones (closes #144)

2026-10-21 02:27:16 +00:00

handlers.go

Enforce channel keys, invites, +s and +H on the IRC listener (closes #122)

2026-10-20 16:02:14 +02:00

healthcheck.go

feat: add runtime statistics to healthcheck endpoint (#80)

2026-03-17 12:43:39 +01:00

utility_test.go

Compare nicks by exact case everywhere (closes #128)

2026-10-20 16:31:28 +02:00

utility.go

Compare nicks by exact case everywhere (closes #128)

2026-10-20 16:31:28 +02:00