Merge branch 'insp3' into master

24 files changed, 270 insertions, 77 deletions

diff --git a/src/modules/m_alias.cpp b/src/modules/m_alias.cpp
index 4d1dd65c9..3e00db765 100644
--- a/src/modules/m_alias.cpp
+++ b/src/modules/m_alias.cpp
@@ -107,6 +107,7 @@ class ModuleAlias : public Module
 
 	ModuleAlias()
 		: botmode(this, "bot")
+		, active(false)
 	{
 	}
 
diff --git a/src/modules/m_cban.cpp b/src/modules/m_cban.cpp
index e0768aa88..3cdbbbdfb 100644
--- a/src/modules/m_cban.cpp
+++ b/src/modules/m_cban.cpp
@@ -114,7 +114,7 @@ class CommandCBan : public Command
 			unsigned long duration;
 			if (!InspIRCd::Duration(parameters[1], duration))
 			{
-				user->WriteNotice("*** Invalid duration for CBan");
+				user->WriteNotice("*** Invalid duration for CBan.");
 				return CMD_FAILURE;
 			}
 			const char *reason = (parameters.size() > 2) ? parameters[2].c_str() : "No reason supplied";
@@ -202,7 +202,7 @@ class ModuleCBan : public Module, public Stats::EventListener
 
 	Version GetVersion() CXX11_OVERRIDE
 	{
-		return Version("Gives /cban, aka C:lines. Think Q:lines, for channels.", VF_COMMON | VF_VENDOR);
+		return Version("Gives /cban, aka C-lines. Think Q-lines, for channels.", VF_COMMON | VF_VENDOR);
 	}
 };
 
diff --git a/src/modules/m_cgiirc.cpp b/src/modules/m_cgiirc.cpp
index 4a5a4fb03..df8201bde 100644
--- a/src/modules/m_cgiirc.cpp
+++ b/src/modules/m_cgiirc.cpp
@@ -34,29 +34,6 @@ enum
 	RPL_WHOISGATEWAY = 350
 };
 
-// We need this method up here so that it can be accessed from anywhere
-static void ChangeIP(LocalUser* user, const irc::sockets::sockaddrs& sa)
-{
-	// Set the users IP address and make sure they are in the right clone pool.
-	ServerInstance->Users->RemoveCloneCounts(user);
-	user->SetClientIP(sa);
-	ServerInstance->Users->AddClone(user);
-	if (user->quitting)
-		return;
-
-	// Recheck the connect class.
-	user->MyClass = NULL;
-	user->SetClass();
-	user->CheckClass();
-	if (user->quitting)
-		return;
-
-	// Check if this user matches any XLines.
-	user->CheckLines(true);
-	if (user->quitting)
-		return;
-}
-
 // Encapsulates information about an ident host.
 class IdentHost
 {
@@ -215,7 +192,7 @@ class CommandWebIRC : public SplitCommand
 
 			// Set the IP address sent via WEBIRC. We ignore the hostname and lookup
 			// instead do our own DNS lookups because of unreliable gateways.
-			ChangeIP(user, ipaddr);
+			user->SetClientIP(ipaddr);
 			return CMD_SUCCESS;
 		}
 
@@ -391,7 +368,7 @@ class ModuleCgiIRC
 				user->uuid.c_str(), user->GetIPString().c_str(), address.addr().c_str(), user->ident.c_str(), newident.c_str());
 
 			user->ChangeIdent(newident);
-			ChangeIP(user, address);
+			user->SetClientIP(address);
 			break; 
 		}
 		return MOD_RES_PASSTHRU;
diff --git a/src/modules/m_check.cpp b/src/modules/m_check.cpp
index f820f2bd0..1d030acc6 100644
--- a/src/modules/m_check.cpp
+++ b/src/modules/m_check.cpp
@@ -200,7 +200,7 @@ class CommandCheck : public Command
 					opcmdlist.Add(oper->AllowedOperCommands.ToString());
 					opcmdlist.Flush();
 					CheckContext::List privlist(context, "permissions");
-					opcmdlist.Add(oper->AllowedPrivs.ToString());
+					privlist.Add(oper->AllowedPrivs.ToString());
 					privlist.Flush();
 				}
 			}
diff --git a/src/modules/m_clearchan.cpp b/src/modules/m_clearchan.cpp
index 016d28737..dec49866c 100644
--- a/src/modules/m_clearchan.cpp
+++ b/src/modules/m_clearchan.cpp
@@ -211,7 +211,7 @@ class ModuleClearChan : public Module
 
 	Version GetVersion() CXX11_OVERRIDE
 	{
-		return Version("Adds /CLEARCHAN that allows opers to masskick, masskill or mass-G/ZLine users on a channel", VF_VENDOR|VF_OPTCOMMON);
+		return Version("Adds /CLEARCHAN that allows opers to masskick, masskill or mass G/Z-line users on a channel.", VF_VENDOR|VF_OPTCOMMON);
 	}
 };
 
diff --git a/src/modules/m_conn_umodes.cpp b/src/modules/m_conn_umodes.cpp
index 1f2fe7455..3132aed40 100644
--- a/src/modules/m_conn_umodes.cpp
+++ b/src/modules/m_conn_umodes.cpp
@@ -38,10 +38,6 @@ class ModuleModesOnConnect : public Module
 
 	void OnUserConnect(LocalUser* user) CXX11_OVERRIDE
 	{
-		// Backup and zero out the disabled usermodes, so that we can override them here.
-		const std::bitset<64> save = ServerInstance->Config->DisabledUModes;
-		ServerInstance->Config->DisabledUModes.reset();
-
 		ConfigTag* tag = user->MyClass->config;
 		std::string ThisModes = tag->getString("modes");
 		if (!ThisModes.empty())
@@ -58,8 +54,6 @@ class ModuleModesOnConnect : public Module
 
 			ServerInstance->Parser.CallHandler("MODE", modes, user);
 		}
-
-		ServerInstance->Config->DisabledUModes = save;
 	}
 };
 
diff --git a/src/modules/m_connectban.cpp b/src/modules/m_connectban.cpp
index d57ffca02..20121f5f9 100644
--- a/src/modules/m_connectban.cpp
+++ b/src/modules/m_connectban.cpp
@@ -73,7 +73,7 @@ class ModuleConnectBan : public Module
 
 			if (i->second >= threshold)
 			{
-				// Create zline for set duration.
+				// Create Z-line for set duration.
 				ZLine* zl = new ZLine(ServerInstance->Time(), banduration, ServerInstance->Config->ServerName, banmessage, mask.str());
 				if (!ServerInstance->XLines->AddLine(zl, NULL))
 				{
@@ -83,7 +83,7 @@ class ModuleConnectBan : public Module
 				ServerInstance->XLines->ApplyLines();
 				std::string maskstr = mask.str();
 				std::string timestr = InspIRCd::TimeString(zl->expiry);
-				ServerInstance->SNO->WriteGlobalSno('x',"Module m_connectban added Z:line on *@%s to expire on %s: Connect flooding",
+				ServerInstance->SNO->WriteGlobalSno('x',"Module m_connectban added Z-line on %s to expire on %s: Connect flooding",
 					maskstr.c_str(), timestr.c_str());
 				ServerInstance->SNO->WriteGlobalSno('a', "Connect flooding from IP range %s (%d)", maskstr.c_str(), threshold);
 				connects.erase(i);
diff --git a/src/modules/m_disable.cpp b/src/modules/m_disable.cpp
new file mode 100644
index 000000000..203f9ee64
--- /dev/null
+++ b/src/modules/m_disable.cpp
@@ -0,0 +1,189 @@
+/*
+ * InspIRCd -- Internet Relay Chat Daemon
+ *
+ *   Copyright (C) 2019 Peter Powell <petpow@saberuk.com>
+ *
+ * This file is part of InspIRCd.  InspIRCd is free software: you can
+ * redistribute it and/or modify it under the terms of the GNU General Public
+ * License as published by the Free Software Foundation, version 2.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+
+#include "inspircd.h"
+
+enum
+{
+	// From ircu.
+	ERR_DISABLED = 517
+};
+
+// Holds a list of disabled commands.
+typedef std::vector<std::string> CommandList;
+
+// Holds whether modes are disabled or not.
+typedef std::bitset<64> ModeStatus;
+
+class ModuleDisable : public Module
+{
+ private:
+	CommandList commands;
+	ModeStatus chanmodes;
+	bool fakenonexistent;
+	bool notifyopers;
+	ModeStatus usermodes;
+
+	void ReadModes(ConfigTag* tag, const std::string& field, ModeType type, ModeStatus& status)
+	{
+		const std::string modes = tag->getString(field);
+		for (std::string::const_iterator iter = modes.begin(); iter != modes.end(); ++iter)
+		{
+			const char& chr = *iter;
+
+			// Check that the character is a valid mode letter.
+			if (!ModeParser::IsModeChar(chr))
+				throw ModuleException(InspIRCd::Format("Invalid mode '%c' was specified in <disabled:%s> at %s",
+					chr, field.c_str(), tag->getTagLocation().c_str()));
+
+			// Check that the mode actually exists.
+			ModeHandler* mh = ServerInstance->Modes->FindMode(chr, type);
+			if (!chr)
+				throw ModuleException(InspIRCd::Format("Non-existent mode '%c' was specified in <disabled:%s> at %s",
+					chr, field.c_str(), tag->getTagLocation().c_str()));
+
+			// Disable the mode.
+			ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "The %c (%s) %s mode has been disabled",
+				mh->GetModeChar(), mh->name.c_str(), type == MODETYPE_CHANNEL ? "channel" : "user");
+			status.set(chr - 'A');
+		}
+	}
+
+	void WriteLog(const char* message, ...) CUSTOM_PRINTF(2, 3)
+	{
+		std::string buffer;
+		VAFORMAT(buffer, message, message);
+
+		if (notifyopers)
+			ServerInstance->SNO->WriteToSnoMask('a', buffer);
+		else
+			ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, buffer);
+	}
+
+ public:
+	void ReadConfig(ConfigStatus& status) CXX11_OVERRIDE
+	{
+		ConfigTag* tag = ServerInstance->Config->ConfValue("disabled");
+
+		// Parse the disabled commands.
+		CommandList newcommands;
+		irc::spacesepstream commandlist(tag->getString("commands"));
+		for (std::string command; commandlist.GetToken(command); )
+		{
+			// Check that the command actually exists.
+			Command* handler = ServerInstance->Parser.GetHandler(command);
+			if (!handler)
+				throw ModuleException(InspIRCd::Format("Non-existent command '%s' was specified in <disabled:commands> at %s",
+					command.c_str(), tag->getTagLocation().c_str()));
+
+			// Prevent admins from disabling COMMANDS and MODULES for transparency reasons.
+			if (handler->name == "COMMANDS" || handler->name == "MODULES")
+				continue;
+
+			// Disable the command.
+			ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "The %s command has been disabled", handler->name.c_str());
+			newcommands.push_back(handler->name);
+		}
+
+		// Parse the disabled channel modes.
+		ModeStatus newchanmodes;
+		ReadModes(tag, "chanmodes", MODETYPE_CHANNEL, newchanmodes);
+
+		// Parse the disabled user modes.
+		ModeStatus newusermodes;
+		ReadModes(tag, "usermodes", MODETYPE_USER, newusermodes);
+
+		// The server config was valid so we can use these now.
+		chanmodes = newchanmodes;
+		usermodes = newusermodes;
+		commands.swap(newcommands);
+
+		// Whether we should fake the non-existence of disabled things.
+		fakenonexistent = tag->getBool("fakenonexistent", tag->getBool("fakenonexistant"));
+
+		// Whether to notify server operators via snomask `a` about the attempted use of disabled commands/modes.
+		notifyopers = tag->getBool("notifyopers");
+	}
+
+	ModResult OnPreCommand(std::string& command, CommandBase::Params& parameters, LocalUser* user, bool validated) CXX11_OVERRIDE
+	{
+		// If a command is unvalidated or the source is not registered we do nothing.
+		if (!validated || user->registered != REG_ALL)
+			return MOD_RES_PASSTHRU;
+
+		// If the command is not disabled or the user has the servers/use-disabled-commands priv we do nothing.
+		if (!stdalgo::isin(commands, command) || user->HasPrivPermission("servers/use-disabled-commands"))
+			return MOD_RES_PASSTHRU;
+
+		// The user has tried to execute a disabled command!
+		user->CommandFloodPenalty += 2000;
+		WriteLog("%s was blocked from executing the disabled %s command", user->GetFullRealHost().c_str(), command.c_str());
+
+		if (fakenonexistent)
+		{
+			// The server administrator has specified that disabled commands should be
+			// treated as if they do not exist.
+			user->WriteNumeric(ERR_UNKNOWNCOMMAND, command, "Unknown command");
+			ServerInstance->stats.Unknown++;
+			return MOD_RES_DENY;
+		}
+
+		// Inform the user that the command they executed has been disabled.
+		user->WriteNumeric(ERR_DISABLED, command, "Command disabled");
+		return MOD_RES_DENY;
+	}
+
+	ModResult OnRawMode(User* user, Channel* chan, ModeHandler* mh, const std::string& param, bool adding) CXX11_OVERRIDE
+	{
+		// If a mode change is remote or the source is not registered we do nothing.
+		if (!IS_LOCAL(user) || user->registered != REG_ALL)
+			return MOD_RES_PASSTHRU;
+
+		// If the mode is not disabled or the user has the servers/use-disabled-modes priv we do nothing.
+		const std::bitset<64>& disabled = (mh->GetModeType() == MODETYPE_CHANNEL) ? chanmodes : usermodes;
+		if (!disabled.test(mh->GetModeChar() - 'A') || user->HasPrivPermission("servers/use-disabled-modes"))
+			return MOD_RES_PASSTHRU;
+
+		// The user has tried to change a disabled mode!
+		const char* what = mh->GetModeType() == MODETYPE_CHANNEL ? "channel" : "user";
+		WriteLog("%s was blocked from executing the disabled %s mode %c (%s)",
+			user->GetFullRealHost().c_str(), what, mh->GetModeChar(), mh->name.c_str());
+
+		if (fakenonexistent)
+		{
+			// The server administrator has specified that disabled modes should be
+			// treated as if they do not exist.
+			user->WriteNumeric(mh->GetModeType() == MODETYPE_CHANNEL ? ERR_UNKNOWNMODE : ERR_UNKNOWNSNOMASK,
+				mh->GetModeChar(), "is unknown mode char to me");
+			return MOD_RES_DENY;
+		}
+
+		// Inform the user that the mode they changed has been disabled.
+		user->WriteNumeric(ERR_NOPRIVILEGES, InspIRCd::Format("Permission Denied - %s mode %c (%s) is disabled",
+			what, mh->GetModeChar(), mh->name.c_str()));
+		return MOD_RES_DENY;
+	}
+
+	Version GetVersion() CXX11_OVERRIDE
+	{
+		return Version("Provides support for disabling commands and modes", VF_VENDOR);
+	}
+};
+
+MODULE_INIT(ModuleDisable)
diff --git a/src/modules/m_dnsbl.cpp b/src/modules/m_dnsbl.cpp
index d1ca800b3..eade39bd7 100644
--- a/src/modules/m_dnsbl.cpp
+++ b/src/modules/m_dnsbl.cpp
@@ -148,7 +148,7 @@ class DNSBLResolver : public DNS::Request
 					if (ServerInstance->XLines->AddLine(kl,NULL))
 					{
 						std::string timestr = InspIRCd::TimeString(kl->expiry);
-						ServerInstance->SNO->WriteGlobalSno('x',"K:line added due to DNSBL match on *@%s to expire on %s: %s",
+						ServerInstance->SNO->WriteGlobalSno('x', "K-line added due to DNSBL match on *@%s to expire on %s: %s",
 							them->GetIPString().c_str(), timestr.c_str(), reason.c_str());
 						ServerInstance->XLines->ApplyLines();
 					}
@@ -166,7 +166,7 @@ class DNSBLResolver : public DNS::Request
 					if (ServerInstance->XLines->AddLine(gl,NULL))
 					{
 						std::string timestr = InspIRCd::TimeString(gl->expiry);
-						ServerInstance->SNO->WriteGlobalSno('x',"G:line added due to DNSBL match on *@%s to expire on %s: %s",
+						ServerInstance->SNO->WriteGlobalSno('x', "G-line added due to DNSBL match on *@%s to expire on %s: %s",
 							them->GetIPString().c_str(), timestr.c_str(), reason.c_str());
 						ServerInstance->XLines->ApplyLines();
 					}
@@ -184,7 +184,7 @@ class DNSBLResolver : public DNS::Request
 					if (ServerInstance->XLines->AddLine(zl,NULL))
 					{
 						std::string timestr = InspIRCd::TimeString(zl->expiry);
-						ServerInstance->SNO->WriteGlobalSno('x',"Z:line added due to DNSBL match on %s to expire on %s: %s",
+						ServerInstance->SNO->WriteGlobalSno('x', "Z-line added due to DNSBL match on %s to expire on %s: %s",
 							them->GetIPString().c_str(), timestr.c_str(), reason.c_str());
 						ServerInstance->XLines->ApplyLines();
 					}
@@ -420,10 +420,14 @@ class ModuleDNSBL : public Module, public Stats::EventListener
 		std::string dnsbl;
 		if (!myclass->config->readString("dnsbl", dnsbl))
 			return MOD_RES_PASSTHRU;
+
 		std::string* match = nameExt.get(user);
-		std::string myname = match ? *match : "";
-		if (dnsbl == myname)
+		if (!match)
+			return MOD_RES_PASSTHRU;
+
+		if (InspIRCd::Match(*match, dnsbl))
 			return MOD_RES_PASSTHRU;
+
 		return MOD_RES_DENY;
 	}
 
diff --git a/src/modules/m_filter.cpp b/src/modules/m_filter.cpp
index 0c8b81e4b..849f99086 100644
--- a/src/modules/m_filter.cpp
+++ b/src/modules/m_filter.cpp
@@ -421,7 +421,7 @@ ModResult ModuleFilter::OnUserPreMessage(User* user, const MessageTarget& msgtar
 		else if (f->action == FA_GLINE)
 		{
 			GLine* gl = new GLine(ServerInstance->Time(), f->duration, ServerInstance->Config->ServerName.c_str(), f->reason.c_str(), "*", user->GetIPString());
-			ServerInstance->SNO->WriteGlobalSno('f', InspIRCd::Format("%s was glined because their message to %s matched %s (%s)",
+			ServerInstance->SNO->WriteGlobalSno('f', InspIRCd::Format("%s was G-lined because their message to %s matched %s (%s)",
 				user->nick.c_str(), target.c_str(), f->freeform.c_str(), f->reason.c_str()));
 			if (ServerInstance->XLines->AddLine(gl,NULL))
 			{
@@ -433,7 +433,7 @@ ModResult ModuleFilter::OnUserPreMessage(User* user, const MessageTarget& msgtar
 		else if (f->action == FA_ZLINE)
 		{
 			ZLine* zl = new ZLine(ServerInstance->Time(), f->duration, ServerInstance->Config->ServerName.c_str(), f->reason.c_str(), user->GetIPString());
-			ServerInstance->SNO->WriteGlobalSno('f', InspIRCd::Format("%s was zlined because their message to %s matched %s (%s)",
+			ServerInstance->SNO->WriteGlobalSno('f', InspIRCd::Format("%s was Z-lined because their message to %s matched %s (%s)",
 				user->nick.c_str(), target.c_str(), f->freeform.c_str(), f->reason.c_str()));
 			if (ServerInstance->XLines->AddLine(zl,NULL))
 			{
@@ -506,9 +506,9 @@ ModResult ModuleFilter::OnPreCommand(std::string& command, CommandBase::Params&
 			}
 			if (f->action == FA_GLINE)
 			{
-				/* Note: We gline *@IP so that if their host doesnt resolve the gline still applies. */
+				/* Note: We G-line *@IP so that if their host doesn't resolve the G-line still applies. */
 				GLine* gl = new GLine(ServerInstance->Time(), f->duration, ServerInstance->Config->ServerName.c_str(), f->reason.c_str(), "*", user->GetIPString());
-				ServerInstance->SNO->WriteGlobalSno('f', InspIRCd::Format("%s was glined because their %s message matched %s (%s)",
+				ServerInstance->SNO->WriteGlobalSno('f', InspIRCd::Format("%s was G-lined because their %s message matched %s (%s)",
 					user->nick.c_str(), command.c_str(), f->freeform.c_str(), f->reason.c_str()));
 
 				if (ServerInstance->XLines->AddLine(gl,NULL))
@@ -521,7 +521,7 @@ ModResult ModuleFilter::OnPreCommand(std::string& command, CommandBase::Params&
 			if (f->action == FA_ZLINE)
 			{
 				ZLine* zl = new ZLine(ServerInstance->Time(), f->duration, ServerInstance->Config->ServerName.c_str(), f->reason.c_str(), user->GetIPString());
-				ServerInstance->SNO->WriteGlobalSno('f', InspIRCd::Format("%s was zlined because their %s message matched %s (%s)",
+				ServerInstance->SNO->WriteGlobalSno('f', InspIRCd::Format("%s was Z-lined because their %s message matched %s (%s)",
 					user->nick.c_str(), command.c_str(), f->freeform.c_str(), f->reason.c_str()));
 
 				if (ServerInstance->XLines->AddLine(zl,NULL))
diff --git a/src/modules/m_haproxy.cpp b/src/modules/m_haproxy.cpp
index e92c45686..ee9079cbf 100644
--- a/src/modules/m_haproxy.cpp
+++ b/src/modules/m_haproxy.cpp
@@ -240,7 +240,7 @@ class HAProxyHook : public IOHookMiddle
 				{
 					case AF_INET:
 						memcpy(&client.in4.sin_addr.s_addr, &recvq[0], 4);
-						memcpy(&server.in4.sin_addr.s_addr, &recvq[4], 8);
+						memcpy(&server.in4.sin_addr.s_addr, &recvq[4], 4);
 						memcpy(&client.in4.sin_port, &recvq[8], 2);
 						memcpy(&server.in4.sin_port, &recvq[10], 2);
 						tlv_index = 12;
@@ -256,12 +256,13 @@ class HAProxyHook : public IOHookMiddle
 
 					case AF_UNIX:
 						memcpy(client.un.sun_path, &recvq[0], 108);
-						memcpy(client.un.sun_path, &recvq[108], 108);
+						memcpy(server.un.sun_path, &recvq[108], 108);
 						tlv_index = 216;
 						break;
 				}
 
-				sock->OnSetEndPoint(server, client);
+				if (!sock->OnSetEndPoint(server, client))
+					return -1;
 
 				// Parse any available TLVs.
 				while (tlv_index < address_length)
diff --git a/src/modules/m_hostchange.cpp b/src/modules/m_hostchange.cpp
index 201c4b59b..4c9b24140 100644
--- a/src/modules/m_hostchange.cpp
+++ b/src/modules/m_hostchange.cpp
@@ -47,7 +47,7 @@ class HostRule
 	std::string suffix;
 
  public:
-	HostRule(const std::string& Host, const std::string& Mask, const insp::flat_set<int>& Ports)
+	HostRule(const std::string& Mask, const std::string& Host, const insp::flat_set<int>& Ports)
 		: action(HCA_SET)
 		, host(Host)
 		, mask(Mask)
diff --git a/src/modules/m_ident.cpp b/src/modules/m_ident.cpp
index ca12a9ba3..803c19846 100644
--- a/src/modules/m_ident.cpp
+++ b/src/modules/m_ident.cpp
@@ -275,12 +275,24 @@ class ModuleIdent : public Module
 		NoLookupPrefix = tag->getBool("nolookupprefix", false);
 	}
 
-	void OnUserInit(LocalUser *user) CXX11_OVERRIDE
+	void OnSetUserIP(LocalUser* user) CXX11_OVERRIDE
 	{
+		IdentRequestSocket* isock = ext.get(user);
+		if (isock)
+		{
+			// If an ident lookup request was in progress then cancel it.
+			isock->Close();
+			ext.unset(user);
+		}
+
 		// The ident protocol requires that clients are connecting over a protocol with ports.
 		if (user->client_sa.family() != AF_INET && user->client_sa.family() != AF_INET6)
 			return;
 
+		// We don't want to look this up once the user has connected.
+		if (user->registered == REG_ALL)
+			return;
+
 		ConfigTag* tag = user->MyClass->config;
 		if (!tag->getBool("useident", true))
 			return;
@@ -289,7 +301,7 @@ class ModuleIdent : public Module
 
 		try
 		{
-			IdentRequestSocket *isock = new IdentRequestSocket(user);
+			isock = new IdentRequestSocket(user);
 			ext.set(user, isock);
 		}
 		catch (ModuleException &e)
diff --git a/src/modules/m_ircv3_echomessage.cpp b/src/modules/m_ircv3_echomessage.cpp
index f6eae5a00..b407aece4 100644
--- a/src/modules/m_ircv3_echomessage.cpp
+++ b/src/modules/m_ircv3_echomessage.cpp
@@ -40,25 +40,26 @@ class ModuleIRCv3EchoMessage : public Module
 		LocalUser* const localuser = static_cast<LocalUser*>(user);
 
 		const std::string& text = details.echo_original ? details.original_text : details.text;
+		const ClientProtocol::TagMap& tags = details.echo_original ? details.tags_in : details.tags_out;
 		if (target.type == MessageTarget::TYPE_USER)
 		{
 			User* destuser = target.Get<User>();
 			ClientProtocol::Messages::Privmsg privmsg(ClientProtocol::Messages::Privmsg::nocopy, user, destuser, text, details.type);
-			privmsg.AddTags(details.tags_in);
+			privmsg.AddTags(tags);
 			localuser->Send(ServerInstance->GetRFCEvents().privmsg, privmsg);
 		}
 		else if (target.type == MessageTarget::TYPE_CHANNEL)
 		{
 			Channel* chan = target.Get<Channel>();
 			ClientProtocol::Messages::Privmsg privmsg(ClientProtocol::Messages::Privmsg::nocopy, user, chan, text, details.type, target.status);
-			privmsg.AddTags(details.tags_in);
+			privmsg.AddTags(tags);
 			localuser->Send(ServerInstance->GetRFCEvents().privmsg, privmsg);
 		}
 		else
 		{
 			const std::string* servername = target.Get<std::string>();
 			ClientProtocol::Messages::Privmsg privmsg(ClientProtocol::Messages::Privmsg::nocopy, user, *servername, text, details.type);
-			privmsg.AddTags(details.tags_in);
+			privmsg.AddTags(tags);
 			localuser->Send(ServerInstance->GetRFCEvents().privmsg, privmsg);
 		}
 	}
diff --git a/src/modules/m_passforward.cpp b/src/modules/m_passforward.cpp
index 08d3533cd..37efec02b 100644
--- a/src/modules/m_passforward.cpp
+++ b/src/modules/m_passforward.cpp
@@ -18,6 +18,7 @@
 
 
 #include "inspircd.h"
+#include "modules/account.h"
 
 class ModulePassForward : public Module
 {
@@ -82,6 +83,13 @@ class ModulePassForward : public Module
 		if (!user->MyClass->config->getString("password").empty())
 			return;
 
+		AccountExtItem* actext = GetAccountExtItem();
+		if (actext && actext->get(user))
+		{
+			// User is logged in already (probably via SASL) don't forward the password
+			return;
+		}
+
 		if (!nickrequired.empty())
 		{
 			/* Check if nick exists and its server is ulined */
diff --git a/src/modules/m_rline.cpp b/src/modules/m_rline.cpp
index 77b3bc3aa..1247e81d3 100644
--- a/src/modules/m_rline.cpp
+++ b/src/modules/m_rline.cpp
@@ -32,7 +32,7 @@ class RLine : public XLine
 {
  public:
 
-	/** Create a R-Line.
+	/** Create a R-line.
 	 * @param s_time The set time
 	 * @param d The duration of the xline
 	 * @param src The sender of the xline
@@ -81,7 +81,7 @@ class RLine : public XLine
 			if (ServerInstance->XLines->AddLine(zl, NULL))
 			{
 				std::string timestr = InspIRCd::TimeString(zl->expiry);
-				ServerInstance->SNO->WriteToSnoMask('x', "Z-line added due to R-line match on *@%s%s%s: %s",
+				ServerInstance->SNO->WriteToSnoMask('x', "Z-line added due to R-line match on %s%s%s: %s",
 					zl->ipaddr.c_str(), zl->duration ? " to expire on " : "", zl->duration ? timestr.c_str() : "", zl->reason.c_str());
 				added_zline = true;
 			}
@@ -150,7 +150,7 @@ class CommandRLine : public Command
 			unsigned long duration;
 			if (!InspIRCd::Duration(parameters[1], duration))
 			{
-				user->WriteNotice("*** Invalid duration for R-line");
+				user->WriteNotice("*** Invalid duration for R-line.");
 				return CMD_FAILURE;
 			}
 			XLine *r = NULL;
@@ -184,7 +184,7 @@ class CommandRLine : public Command
 				else
 				{
 					delete r;
-					user->WriteNotice("*** R-Line for " + parameters[0] + " already exists");
+					user->WriteNotice("*** R-line for " + parameters[0] + " already exists.");
 				}
 			}
 		}
@@ -196,7 +196,7 @@ class CommandRLine : public Command
 			}
 			else
 			{
-				user->WriteNotice("*** R-Line " + parameters[0] + " not found in list, try /stats R.");
+				user->WriteNotice("*** R-line " + parameters[0] + " not found in list, try /stats R.");
 			}
 		}
 
@@ -279,15 +279,15 @@ class ModuleRLine : public Module, public Stats::EventListener
 		if (!rxfactory)
 		{
 			if (newrxengine.empty())
-				ServerInstance->SNO->WriteToSnoMask('a', "WARNING: No regex engine loaded - R-Line functionality disabled until this is corrected.");
+				ServerInstance->SNO->WriteToSnoMask('a', "WARNING: No regex engine loaded - R-line functionality disabled until this is corrected.");
 			else
-				ServerInstance->SNO->WriteToSnoMask('a', "WARNING: Regex engine '%s' is not loaded - R-Line functionality disabled until this is corrected.", newrxengine.c_str());
+				ServerInstance->SNO->WriteToSnoMask('a', "WARNING: Regex engine '%s' is not loaded - R-line functionality disabled until this is corrected.", newrxengine.c_str());
 
 			ServerInstance->XLines->DelAll(f.GetType());
 		}
 		else if ((!initing) && (rxfactory.operator->() != factory))
 		{
-			ServerInstance->SNO->WriteToSnoMask('a', "Regex engine has changed, removing all R-Lines");
+			ServerInstance->SNO->WriteToSnoMask('a', "Regex engine has changed, removing all R-lines.");
 			ServerInstance->XLines->DelAll(f.GetType());
 		}
 
@@ -331,7 +331,7 @@ class ModuleRLine : public Module, public Stats::EventListener
 
 	void OnUnloadModule(Module* mod) CXX11_OVERRIDE
 	{
-		// If the regex engine became unavailable or has changed, remove all rlines
+		// If the regex engine became unavailable or has changed, remove all R-lines.
 		if (!rxfactory)
 		{
 			ServerInstance->XLines->DelAll(f.GetType());
diff --git a/src/modules/m_samode.cpp b/src/modules/m_samode.cpp
index 8f28a7e9c..db3345b98 100644
--- a/src/modules/m_samode.cpp
+++ b/src/modules/m_samode.cpp
@@ -124,6 +124,9 @@ class ModuleSaMode : public Module
 
 	void Prioritize() CXX11_OVERRIDE
 	{
+		Module* disabled = ServerInstance->Modules->Find("m_disabled.so");
+		ServerInstance->Modules->SetPriority(this, I_OnRawMode, PRIORITY_BEFORE, disabled);
+
 		Module *override = ServerInstance->Modules->Find("m_override.so");
 		ServerInstance->Modules->SetPriority(this, I_OnPreMode, PRIORITY_BEFORE, override);
 	}
diff --git a/src/modules/m_shun.cpp b/src/modules/m_shun.cpp
index e4fb2c11d..6453ace81 100644
--- a/src/modules/m_shun.cpp
+++ b/src/modules/m_shun.cpp
@@ -92,7 +92,7 @@ class CommandShun : public Command
 			{
 				if (!InspIRCd::Duration(parameters[1], duration))
 				{
-					user->WriteNotice("*** Invalid duration for SHUN");
+					user->WriteNotice("*** Invalid duration for SHUN.");
 					return CMD_FAILURE;
 				}
 				expr = parameters[2];
@@ -122,7 +122,7 @@ class CommandShun : public Command
 			else
 			{
 				delete r;
-				user->WriteNotice("*** Shun for " + target + " already exists");
+				user->WriteNotice("*** Shun for " + target + " already exists.");
 				return CMD_FAILURE;
 			}
 		}
diff --git a/src/modules/m_spanningtree/away.cpp b/src/modules/m_spanningtree/away.cpp
index 13972589b..62300580f 100644
--- a/src/modules/m_spanningtree/away.cpp
+++ b/src/modules/m_spanningtree/away.cpp
@@ -47,6 +47,6 @@ CmdResult CommandAway::HandleRemote(::RemoteUser* u, Params& params)
 CommandAway::Builder::Builder(User* user)
 	: CmdBuilder(user, "AWAY")
 {
-	if (user->awaymsg.empty())
+	if (!user->awaymsg.empty())
 		push_int(user->awaytime).push_last(user->awaymsg);
 }
diff --git a/src/modules/m_spanningtree/main.cpp b/src/modules/m_spanningtree/main.cpp
index 985762872..de1e8eb19 100644
--- a/src/modules/m_spanningtree/main.cpp
+++ b/src/modules/m_spanningtree/main.cpp
@@ -324,8 +324,12 @@ ModResult ModuleSpanningTree::HandleVersion(const CommandBase::Params& parameter
 		// If it's empty it might be that the server is still syncing (full version hasn't arrived yet)
 		// or the server is a 2.0 server and does not send a full version.
 		bool showfull = ((user->IsOper()) && (!found->GetFullVersion().empty()));
-		const std::string& Version = (showfull ? found->GetFullVersion() : found->GetVersion());
-		user->WriteNumeric(RPL_VERSION, Version);
+
+		Numeric::Numeric numeric(RPL_VERSION);
+		irc::tokenstream tokens(showfull ? found->GetFullVersion() : found->GetVersion());
+		for (std::string token; tokens.GetTrailing(token); )
+			numeric.push(token);
+		user->WriteNumeric(numeric);
 	}
 	else
 	{
diff --git a/src/modules/m_spanningtree/treesocket.h b/src/modules/m_spanningtree/treesocket.h
index 878b34ad7..6206448c1 100644
--- a/src/modules/m_spanningtree/treesocket.h
+++ b/src/modules/m_spanningtree/treesocket.h
@@ -259,7 +259,7 @@ class TreeSocket : public BufferedSocket
 	 */
 	void SendFJoins(Channel* c);
 
-	/** Send G, Q, Z and E lines */
+	/** Send G-, Q-, Z- and E-lines */
 	void SendXLines();
 
 	/** Send all known information about a channel */
diff --git a/src/modules/m_spanningtree/treesocket2.cpp b/src/modules/m_spanningtree/treesocket2.cpp
index dc24802fb..45f8a380f 100644
--- a/src/modules/m_spanningtree/treesocket2.cpp
+++ b/src/modules/m_spanningtree/treesocket2.cpp
@@ -292,7 +292,7 @@ void TreeSocket::ProcessTag(User* source, const std::string& tag, ClientProtocol
 	for (Events::ModuleEventProvider::SubscriberList::const_iterator i = list.begin(); i != list.end(); ++i)
 	{
 		ClientProtocol::MessageTagProvider* const tagprov = static_cast<ClientProtocol::MessageTagProvider*>(*i);
-		const ModResult res = tagprov->OnClientProtocolProcessTag(source, tagkey, tagval);
+		const ModResult res = tagprov->OnProcessTag(source, tagkey, tagval);
 		if (res == MOD_RES_ALLOW)
 			tags.insert(std::make_pair(tagkey, ClientProtocol::MessageTagData(tagprov, tagval)));
 		else if (res == MOD_RES_DENY)
diff --git a/src/modules/m_sslinfo.cpp b/src/modules/m_sslinfo.cpp
index 54aeb9755..30dfd9a76 100644
--- a/src/modules/m_sslinfo.cpp
+++ b/src/modules/m_sslinfo.cpp
@@ -54,8 +54,7 @@ class SSLCertExt : public ExtensionItem
 
 	void unset(Extensible* container)
 	{
-		void* old = unset_raw(container);
-		delete static_cast<std::string*>(old);
+		free(container, unset_raw(container));
 	}
 
 	std::string serialize(SerializeFormat format, const Extensible* container, void* item) const CXX11_OVERRIDE
diff --git a/src/modules/m_svshold.cpp b/src/modules/m_svshold.cpp
index 52c250fef..0aaf113f0 100644
--- a/src/modules/m_svshold.cpp
+++ b/src/modules/m_svshold.cpp
@@ -76,7 +76,7 @@ class SVSHoldFactory : public XLineFactory
  public:
 	SVSHoldFactory() : XLineFactory("SVSHOLD") { }
 
-	/** Generate a shun
+	/** Generate an SVSHOLD
  	*/
 	XLine* Generate(time_t set_time, unsigned long duration, const std::string& source, const std::string& reason, const std::string& xline_specific_mask) CXX11_OVERRIDE
 	{
@@ -130,7 +130,7 @@ class CommandSvshold : public Command
 			unsigned long duration;
 			if (!InspIRCd::Duration(parameters[1], duration))
 			{
-				user->WriteNotice("*** Invalid duration for SVSHOLD");
+				user->WriteNotice("*** Invalid duration for SVSHOLD.");
 				return CMD_FAILURE;
 			}
 			SVSHold* r = new SVSHold(ServerInstance->Time(), duration, user->nick.c_str(), parameters[2].c_str(), parameters[0].c_str());
@@ -221,7 +221,7 @@ class ModuleSVSHold : public Module, public Stats::EventListener
 
 	Version GetVersion() CXX11_OVERRIDE
 	{
-		return Version("Implements SVSHOLD. Like Q:Lines, but can only be added/removed by Services.", VF_COMMON | VF_VENDOR);
+		return Version("Implements SVSHOLD. Like Q-lines, but can only be added/removed by Services.", VF_COMMON | VF_VENDOR);
 	}
 };