Compare access entries created with the levels access system by access level and not by privilege set, as two entries can have the same privset but different levels, but still represent two different levels of access. This prevented users from adding other users at a lower access level when that level had the same privset as them. Spotted by TSG.

1 files changed, 21 insertions, 1 deletions

diff --git a/modules/commands/cs_access.cpp b/modules/commands/cs_access.cpp
index 0ecf95106..7a2d1a35b 100644
--- a/modules/commands/cs_access.cpp
+++ b/modules/commands/cs_access.cpp
@@ -43,13 +43,32 @@ class AccessChanAccess : public ChanAccess
 	{
 		this->level = convertTo<int>(data);
 	}
+
+	bool operator>(const ChanAccess &other) const anope_override
+	{
+		if (this->provider != other.provider)
+			return ChanAccess::operator>(other);
+		else
+			return this->level > anope_dynamic_static_cast<const AccessChanAccess &>(other).level;
+	}
+
+	bool operator<(const ChanAccess &other) const anope_override
+	{
+		if (this->provider != other.provider)
+			return ChanAccess::operator<(other);
+		else
+			return this->level < anope_dynamic_static_cast<const AccessChanAccess &>(other).level;
+	}
 };
 
 class AccessAccessProvider : public AccessProvider
 {
  public:
+	static AccessAccessProvider *me;
+
 	AccessAccessProvider(Module *o) : AccessProvider(o, "access/access")
 	{
+		me = this;
 	}
 
 	ChanAccess *Create() anope_override
@@ -57,6 +76,7 @@ class AccessAccessProvider : public AccessProvider
 		return new AccessChanAccess(this);
 	}
 };
+AccessAccessProvider* AccessAccessProvider::me;
 
 class CommandCSAccess : public Command
 {
@@ -91,7 +111,7 @@ class CommandCSAccess : public Command
 		AccessGroup u_access = source.AccessFor(ci);
 		const ChanAccess *highest = u_access.Highest();
 
-		AccessChanAccess tmp_access(NULL);
+		AccessChanAccess tmp_access(AccessAccessProvider::me);
 		tmp_access.ci = ci;
 		tmp_access.level = level;