Fix cloak_md5 leaking the cloak key over server links.

This was introduced when adding the modern cloak system and does
not affect v3.

1 files changed, 9 insertions, 2 deletions

diff --git a/src/modules/m_cloak_md5.cpp b/src/modules/m_cloak_md5.cpp
index 9eca2189b..0e2971d85 100644
--- a/src/modules/m_cloak_md5.cpp
+++ b/src/modules/m_cloak_md5.cpp
@@ -219,11 +219,18 @@ struct CloakInfo final
 				break;
 		}
 		data["domain-parts"] = ConvToStr(domainparts);
-		data["hash"] = Hash ? Hash->name : "broken";
 		data["ignore-case"] = ignorecase ? "yes" : "no";
-		data["key"] = key;
 		data["prefix"] = prefix;
 		data["suffix"] = suffix;
+
+		// IMPORTANT: link data is sent over unauthenticated server links so we
+		// can't directly send the key here. Instead we use dummy cloaks that
+		// allow verification of or less the same thing.
+		const std::string broken = "missing-sha2-module";
+		data["cloak-v4"]   = Hash ? Generate("123.123.123.123")    : broken;
+		data["cloak-v6"]   = Hash ? Generate("dead:beef:cafe::")   : broken;
+		data["cloak-host"] = Hash ? Generate("cloak.inspircd.org") : broken;
+
 		compatdata = GetCompatLinkData();
 	}