From d165db786cbeece21655bb1f17eb696c1ef63794 Mon Sep 17 00:00:00 2001
From: sterni <sternenseemann@systemli.org>
Date: Sat, 6 Jun 2026 17:44:53 +0200
Subject: [PATCH] inspircd: apply patches for missing escaping in LDAP modules

This can be used to bypass auth or gain privileges for certain
configurations.
https://docs.inspircd.org/security/2026-01/
---
 pkgs/by-name/in/inspircd/package.nix | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/pkgs/by-name/in/inspircd/package.nix b/pkgs/by-name/in/inspircd/package.nix
index 1980e8707107..7e0807931cf2 100644
--- a/pkgs/by-name/in/inspircd/package.nix
+++ b/pkgs/by-name/in/inspircd/package.nix
@@ -67,6 +67,7 @@ in
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   nixosTests,
   perl,
   pkg-config,
@@ -157,6 +158,22 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-fMfsNbkp9M8KiuhwOEFmPjowZ4JLP4IpX6LRO9aLHzY=";
   };
 
+  patches = [
+    # Additions to LDAP code for the benefit of the next patch
+    (fetchpatch {
+      name = "inspircd-ldap-api.patch";
+      url = "https://github.com/inspircd/inspircd/commit/b7e5357b144c2e20c72431e22f0f2b13e5be82ce.patch";
+      hash = "sha256-nrgjmSBEIXdhlu/3WbMspIgSTHR29D4TfvKZ26JcYHs=";
+    })
+    # Resolves missing escaping in LDAP search filters which can be used to bypass auth
+    # https://docs.inspircd.org/security/2026-01/
+    (fetchpatch {
+      name = "inspircd-ldap-filter-escape.patch";
+      url = "https://github.com/inspircd/inspircd/commit/6319ae4fb8c10dabc9464ad49faec532096fbcb5.patch";
+      hash = "sha256-RtwNZA3PZDtQ5wW0TfCrvD+zfQHTFLg4mQRP5/qrAzg=";
+    })
+  ];
+
   outputs = [
     "bin"
     "lib"