Allow user mode +x only when "CloakHostModeX" is set

Allow users to "cloak" their hostname only when the configuration
variable "CloakHostModeX" (introduced in 19.2) is set. Otherwise, only
IRC opertators, other servers, and services are allowed to set mode +x.

This prevents regular users from changing their hostmask to the name
of the IRC server itself, which confused quite a few people ;-)

This fixes bug #133.

INSTALL

@@ -12,6 +12,14 @@
 I. Upgrade Information
 ~~~~~~~~~~~~~~~~~~~~~~
 
+Differences to version 19.x
+
+- Starting with ngIRCd 20, users can "cloak" their hostname only when the
+  configuration variable "CloakHostModeX" (introduced in 19.2) is set.
+  Otherwise, only IRC opertators, other servers, and services are allowed to
+  set mode +x. This prevents regular users from changing their hostmask to
+  the name of the IRC server itself, which confused quite a few people ;-)
+
 Differences to version 17
 
 - Support for ZeroConf/Bonjour/Rendezvous service registration has been

src/ngircd/irc-mode.c

@@ -278,9 +278,15 @@ Client_Mode( CLIENT *Client, REQUEST *Req, CLIENT *Origin, CLIENT *Target )
 				ok = IRC_WriteStrClient(Origin,
 							ERR_RESTRICTED_MSG,
 							Client_ID(Origin));
-			else
+			else if (!set || Conf_CloakHostModeX[0]
+				 || Client_Type(Client) == CLIENT_SERVER
+				 || Client_OperByMe(Client)) {
 				x[0] = 'x';
 				send_RPL_HOSTHIDDEN_MSG = true;
+			} else
+				ok = IRC_WriteStrClient(Origin,
+							ERR_NOPRIVILEGES_MSG,
+							Client_ID(Origin));
 			break;
 		default:
 			if (Client_Type(Client) != CLIENT_SERVER) {