Known Unfixed bugs. Unfixed bugs go on top, Fixed on bottom.

Highest bug # is 100  

#99 weird bug in maingui.c; if you unlink then relink a tab and then try to
close it, it will try to free() the WRONG memory. Don't know why yet.

#91 The "Disable paned userlist" option has no effect except for hiding the
vertical handle bar

#88 /lastlog window does not have working mouse wheel scrolling.

#55 Enhancing the text buffer broke /dns and /exec (NOT /exec -o) text
printing; the time stamp currently does not print for these.

#51 quit command or closing the client do not always actually send the quit
message.

#39 Fix logic error with doing dcc draw; if you've already offered a dcc
draw you can't accept one from the same person. (even if its YOU) Also
consider extending dcc draw.

#24 dcc send/recieves that are resumed get bogus CPS values, thinking that
whatever amount resumed was actually sent/recieved.

#4 If you press enter on the far right keypad with numlock, lurc will print
a strange symbol which will do a <cr> when you press the normal enter key
but it just plain isn't what you expect.


FIXED BUGS:

#1 Various security problems.
(mostly from)
http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=xchat
(if there are new ones listed there not listed here, scream at Hikaru)

CAN-2004-0409
Socks5 code removed. (Yes, it affected us despite the version numbers
listed)
UPDATE:09/06/05
This was not the actual code that was affected by the exploit - however,
unfortunately, the library is no longer in the wild. If someone can find a
copy of libsocks5.so and socks5.h/socks.h I will reimpliment this code as it
is trivial.

CVE-2002-0382
/dns command reimplimented to use host instead of nslookup
/exec command reimpilmented to directly call the program, rather than rely
on /bin/sh
UPDATE:09/02/05
Due to the amount of people attempting to exploit my client, /exec has been
temporarily disabled (from 0.0.2 on) - will be reenabled once I am certain
no more exploits can affect the client.
UPDATE:09/06/05
/exec reimplimented to use bash again, but with a filter to prevent bashisms
from destroying security.
UPDATE:03/23/06
/dns reimplimented to directly spawn host instead of relying on /exec; this
is both safer *and* allowed me to remove the damned annoying filter from the
/exec code.

CVE-2000-0787
URL catcher buttons are disabled; firefox/dillo buttons are in the source
but commented out because of security issues with them. (firefox is a
SCRIPT, so even directly calling it you can do `bash` and it'll run the
command) I need to add URL filtering before I can reenable these or expand
the abilities of the URL catcher.
UPDATE:09/06/05
Reimplimented all of these so they're using handle_command - the new filter
for URL grabbing and the filter on /exec should prevent problems with
exploitable URLs.
UPDATE:03/23/06
This problem was actually identified as a problem in firefox/mozilla and has
been fixed in those programs, original implementation has been restored.

CVE-2001-0792 and CVE-2002-0006
%123 etc translation thrown out due to security problems (this fixes *two*
issues)
UPDATE: 09/02/05
Rewrote a hefty chunk of code, 0.0.3 supports %123 decimal ascii translation
again, and with the new cr+lf filter for input from the server and input
from the user, it should be impossible for a exploit to happen again from
this code. - unfortunately current implementation is buggier-than-thou and
tends to mangle input sequences, I don't use this so it proboably won't be
fixed soon.
UPDATE: 11/04/07
Thrown out again.

CAN-2003-1000
Does not affect this code.

#6 If you set /away manually without using the menus or come back by using
/away without a parameter, lurc is not aware of it.
FIXED 09/03/05

#2 If 'New Tabs to Front' is enabled in settings/setup/options, when you
connect to a large amount of channels with a lot of users on them,
one or more of the windows will be corrupted and display incorrect
information, if anything at all.
FIXED.

#7 /exec code needs bugfixing, short GNU style options (eg, -c) fuckup.
Can't do du -mc ~/music for instance.
09/06/05
FIXED, reverted to original execl (/bin/sh) code - Filter implimented to
protect against bashisms that could cause problems.
03/23/06
Removed the filter as it's annoying, /dns command has been fixed so the
filter isn't necessary. (NO command should EVER run /exec via
handle_command)

#12 color generator uses really hard to see colors when colored nicknames is
on.
FIXED 09/09/05

#15
Various problems with memory handling detected by Valgrind.
FIXED. Most of the heavy lifting due to Taniwha. (Bill Currie)

#18
Very fucking WEIRD logfile writing bug fixed; Symptoms were logs being
written to the wrong logfiles, the client flooding itself off servers, logs
not being written, logs filled with gibberish. This was the bug that made me
start fixing all of those wacky security problems.
FIXED

#19
After restoring the rejoin on kick && reconnect after disconnect code, I
noticed that the rejoin on kick code didn't actually work, and would
actually only trigger if you tried to /part a channel. Heh.
Silly bug.
FIXED

#20
Logfiles that couldn't be opened would be continually tried to be opened.
Now stops trying and informs the user.
FIXED

#21
Fixed serious possible problems with file opening/writing - most did not
have error detection or handling.
FIXED

#23 memory corruption bug in display code for text, also fixed memory
corruption bug in accepting dccs which do not exist locally.
FIXED

#22 Bug in dcc chats - dialogs already open will just have the text print to
you, but you send to them in a msg; if the person ever had a previous dcc
chat, the same problem will occur. Workaround for now is to close any open
dialogs for the user in question and also 'abort' failed dcc chats in the
dcc chat menu.
FIXED
- Inverted true/false was confusing the client into
thinking the chat was open after it was closed already. Oops.

#17 Bug that appeared to be due to /lastlog; was actually an off by 1
read which caused dramatic memory corruption
FIXED

#5 logging produces weird ^O looking things, see if we can fix that.
strip_color was bugged, backported strip_color from xchat 1.8.11
FIXED

#26 Bug that prevented logging of channels with / in the name;
backported fix from xchat 1.8.11
FIXED

#27 ignore file loading; was causing memory corruption previously,
basically the same fix as bug #15 (thanks again taniwha)
FIXED

#28 nearly all uses of fstat didn't check if the file existed
correctly, could have caused wacky crashes, related to #23's dcc bug
FIXED

#30 when colored nicks were turned on, nickname highlighting and
channel tab highlighting did not work
FIXED

#31 if you went into a channel that was mode +i and had either
mode +l/+k the UI would act very, very strange.
FIXED

#32 Serious overflow bugs were found by ircfuzz, took a lot of code
rewriting to fix; strcmp/sprintf/strcat are now strncmp/snprintf/strncat -
also process_data_init had all the loops checked for possible (even totally
unlikely) error conditions, like falling off the end of the variables.
Finally, the code which recieves data from a server in an infinite loop had
some code backported and reworked from xchat 2.6.6 to make it deal with
overflowing the buffers there.
FIXED

#35 Bug in dialog windows/tabs where there is no separator between the
text input box and the display above it.
FIXED

#40 Bug in cfg file reader, used to not check if the parameter it was
reading might overflow the variable it was writing to.
FIXED

#41 Bug in handling server notices; sometimes the client would crash.
Fix keeps the message instead of destroying it like xchat
FIXED

#37 Bug in user commands; need to backport the fix from the fixed 1.8.11
branch
FIXED

#40 bug with logging user-user chats; nickname changes did not close
the log prior to this, and could cause silly problems.
FIXED

#41 bug with nickname changes+user quits not showing in dialogs.
FIXED

#36 Bug in color handling, color 5 is dim yellow when it ought to be
dim red, problem shows up on both incoming colors and outgoing ones.
FIXED

#42 bug with /dns command producing cut off output.
FIXED

#43 bug with too long lines pasted/typed in getting cut off; partial
backport from xchat 1.8.11 and 2.6.6
FIXED

#3 If 'Time Stamp All Text' is enabled in settings/setup/options, when you
tell xchat to autocomplete a command name and instead it lists the ones
available, it will show the command names with timestamps mixed in with the
text. Stupid bug, should be reasonably simple to fix, but I've got other
things on my mind.
FIXED 06/05/07

#45 nickname completion is buggy in general, might backport.
FIXED 6/05/07
now presents a list if it can't choose just one nickname

#25 nickname completion via TAB doesn't let you choose multiple entries.
FIXED 06/05/07
Now presents a list instead of forcechoosing one.

#46 /help had the same timestamping problems that command completion did.
FIXED 06/05/07

#44 dcc sends do not time out.
FIXED 06/08/07
code was not initializing the configuration variables with a default
timeout.

#38 Check for and fix configurator bug: If lurc will destroy the config file
if the version of the client is different from the one in the config file,
REMOVE this damned misfeature. 
NOTFIXED - Problem nonexistent.

#34 Running client as root only warns you. Should change this to having an
explicit error message and doing abort() - I do NOT want to make ircing as
root allowed.
FIXED 06/08/07

#29 Autoconnect code needs to be implimented. It's been WAY too long. :)
FIXED 06/19/07

#47 Bug in action handling is adding an extra space.
FIXED 7/17/07

#46 If you connect to an irc server using a dialog window/tab things go awry
FIXED 7/18/07

#33 Can't choose colors for window/dialogs from settings menu. as a
workaround you can change the colors in the config file, but this is silly.
FIXED 08/07/07

#48 dialog window input box text has the colors meant to be used for channel
window input box
FIXED 08/07/07

#49 cfg files parser treats colors as booleans AND numbers, causing spurious
error messages on console with colors that are greater than 9
FIXED 08/07/07

#50 bootstrap script was released with version 0.0.3.1 setup so it wouldn't
compile properly.
FIXED 09/11/07

#52 /away would badly malfunction if the away reason entered was more than
119 bytes.
FIXED 10/15/07

#53 autoswitching to a different nickname upon connection to an irc server
caused inconsistent and confusing handling of the login message.
FIXED 10/17/07

#57 Giving the client too much I/O will crash the client with a
segementation fault due to *HUNDREDS* of attempted calls to read_data
simultaneously.
FIXED 10/20/2007

#54 pressing the up cursor will destroy all text currently entered into the
input box. Also, once the history has been filled, it will never stop at the
top or bottom while walking through it, but wrap around instead, leaving
the user with no clue where it begins and ends.
FIXED 11/01/2007

#56 putting /join in an auto connect command will cause the client to insert
two channels into one window/dialog sometimes.
FIXED 11/03/07 
Was fixed in development svn after 0.0.3.2 and before release of 0.0.4

#59
Formatting bug in display_event causing check_special_chars to make silly
errors appear on the display; A good example is typing in a % on an
otherwise empty line prints a %O when in a channel/dialog.
FIXED 11/05/07

#60
If 'Show server messages in their own tab/window' is DISABLED, autoconnect
will create an extra session tab for each server you autoconnect to.
FIXED 11/05/07

#58 Giving the client too much I/O will freeze up the GUI - client cannot
even respond to signals or the close button. Seems to be related to the
gtk_text_insert function, since disabling all calls to that make it work
perfectly - however, reprioritizing it to a low value had no effect. Note to
devs: Xchat has this same problem, tested 1.8.11 and 2.6.6. Note to users:
This problem has only been seen when testing the client on a tool designed
to overload the client on purpose. You will likely never see this problem in
the wild - though we'd like to hear about it if you *do* - If the client
does misbehave in this way to close it you'll have to either killall -9 lurc
from a command line or if you ran it from a console you can ctrl-c it from
there.
FIXED 11/18/07

#62 The /help command won't scroll the buffer.
Was caused by a silly bug in the scrolling handling in printtextraw.
Likely was causing other problems.
FIXED 11/20/07

#61 Too much input from an ircd will occasionally cause broken lines to be
printed to the screen. An example that will cause this is to go to
windows->channel list window and refresh the list. On an ircd with enough
channels, this will cause broken input.
Was caused by nonsense code in read_data pointed out by phrosty.
FIXED 11/25/07

#65 %C1,1 and %C0,0 are forced internally to use different colors. Likely an
attempted feature to make it easy to read, but this is not what people
expect the client to do.
FIXED 1/19/08

#66 /me done by other people which should have a highlight color assigned to
their nickname is not done correctly. Tab coloring works however.
FIXED 1/19/08

#63 After enabling/disabling show server tabs in their own message
tab/window, the client will need a restart before the change fully takes
effect. This was documented using the noapply popup in settings.c like the
other similar cases.
FIXED 1/19/08

#67 Closing/disconnecting from a server/reconnecting to a server/connecting
to a different server with server messages tab open causes the messages to
show up in a random window, if at all, and sometimes doesn't print them
until you start talking on a channel.
FIXED 1/28/08

#68 doing /motd after being connected confuses the client into resending
authentication commands.
FIXED 1/30/08

#64 Input from the ircd which has data that *looks* like control codes will
be mangled by the parser.
FIXED 1/30/08

#69 Right click menu for tab navigation sometimes displays bogus
information.
FIXED 1/30/08

#71 Notices would sometimes be printed to entirely unrelated tabs.
FIXED 2/10/08

#70 Reconnecting to a server manually causes an extra session to be
generated.
FIXED 2/10/08

#72 Half ops are not known to exist by the client, so will cause various
silly malfunctions on irc servers where they appear: the user list will have
the nickname prefixed with a %, and tab nickname completion will prefix the
nickname with a % as well. If someone loses their halfop status the client
will become confused and wind up having a stale entry in the user list. A
workaround for now is to use /names which will update the list manually,
however obviously this isn't a fun problem.
FIXED 2/28/08

#73 The notify widget can indeed be set to zero, which will cause an abort()
crash. Users of 0.0.5.1 can workaround this problem by setting the
notification timer to zero, which will disable notifications.
FIXED 3/1/08

#75 with paned userlist enabled, the show/hide userlist button malfunctions
reproducably. Likely this feature (for the PANED userlist) will be removed
as the current implementation is a painfully stupid hack.
FIXED 3/05/08
The new implimentation literally hides the user list widget. Imperfect
solution, but less hacky than the original, which simply moved the scroll
bar around and did not work correctly if your screen was large enough.

#76 cfg handling does not initialize preferences correctly, this would only
affect you if you were upgrading from a previous version and new options
appeared.
FIXED 3/05/08

#74 With reconnects enabled, the client often can wind up reconnecting both
too fast and infinitely. Client now will wait 60 seconds before attempting
to reconnect to the irc server, which should be long enough that allowing it
to infinitely reconnect should not be a problem.
FIXED 3/10/08

#79 login (real name) was not checked for color codes before being sent.
FIXED 3/21/08

#80 kill text event message gave totally bogus information when you were
killed by someone. Now gives full path and reason.
FIXED 3/24/08

#81 Serverlist and ignore cfg loaders were incredibly dumb and would tend to
enjoy eating peoples cfg files if they did not find an item they were
looking for in the cfg, this usually would be encountered when someone
attempted upgrading and we had added something to the format. 
FIXED 3/30/08
The cfg loaders however do not understand out of order config files, this is
TODO #24.

#82 Depending on your luck, using the /server command would sometimes use
stale connection data from the previous attempt using the menus. Now
wipes out any connection details before starting a connection.
FIXED 4/2/08

#83 boolean/numbered cfgs blow away their initialized settings
FIXED 4/4/08

#84 Joins never triggered any Tab Alert. Fixed this and added an all new and
improved logic on Tab Highlighting.
FIXED 4/9/08

#85 malloc()'s were not always checked for error conditions. Fixed behavior
now makes the client intentionally exit(255) upon encountering a failure.
This may have fixed a theoretical security problem.
FIXED 4/19/08

#86 User defined commands input box had a bug where it'd refuse to accept
input larger than 40 charachters long, and would in fact truncate longer
lines to that value.
FIXED 5/01/08

#87 /ping, /dns, and /whois replies do not print to the current selected tab.
FIXED 8/11/08

#89 DCC sends do not work when using a proxy (ala stunnel)
FIXED 8/22/08

#90 channel ban list did not print to the channel you tried to list, but to
the server tab. Oops.
FIXED 9/17/08

#92 Recieved notices always showed up in server tab.
FIXED 10/3/08

#93 Recieving a dcc could (sometimes) crash the client due to unintialized
pointers.
FIXED 10/13/08

#94 DCC send/recv were very slow sometimes as little as 20KB/S due to being
overly cautious with select
FIXED 10/13/08

#95 DCC send/recv were run in different threads and so could have *strange*
things happen to the contents of the struct dcc they were managing if one
thread was reading the struct while another was modifying it.
FIXED 10/13/08

#96 wallchop command was completely broken.
FIXED 10/19/08

#97 Topic GUI in channels could only hold the first 254 charachters of the
topic. This often was not enough space for the full topic.
FIXED 10/31/08

#98 If you were connected to multiple servers and closed a tab that had a
different server connection than the tab that was selected after it was
closed, the next time you recieved a message that wanted to print to the
currently selected tab, the client would crash.
FIXED 11/09/08

#100 If you /part a channel with a reason without explicitly stating the
channel, only the first word of the part message is sent.
FIXED 11/25/08
