From 4f998dd9fcdd325cecbaef183447bf92e44d9d4f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lukas=20Br=C3=BCbach?= <Bruebach.Lukas@bdosecurity.de>
Date: Wed, 2 Sep 2026 13:52:25 +0200
Subject: [PATCH] [Server] Exclude chat rows when private-chat filter is
 bypassable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A developer who omits log_location entirely — or sends only "chat" —
leaves chatType, gameType, roomType all false, so getMessageLogHistory
skips the target_type clause and returns every row, private messages
included. When !allowPrivateChat the server now forces game+room when
no surviving location was requested, guaranteeing the query always
carries a target_type restriction.

[Client] Demote mod+dev to moderator path in log-tab dispatch

The developer command family is strictly weaker than the moderator one
(no private chat, no sender_ip, ip filter ignored), so granting the
developer bit to an existing moderator must not silently strip their
capabilities. useDeveloperCommands is now true only when the user holds
the developer bit and not the moderator bit.

[Client] Hide the IP-address filter for developer log tab users

The developer path ignores the ip_address query field server-side.
Showing the field lets a developer type an IP and get results that are
silently unfiltered by it rather than an empty result set — reads as a
broken filter. Hide labelFindIPAddress/findIPAddress alongside the
privateChat checkbox.
---
 cockatrice/src/interface/widgets/tabs/tab_logs.cpp     |  4 ++++
 .../src/interface/widgets/tabs/tab_supervisor.cpp      |  7 +++++--
 servatrice/src/serversocketinterface.cpp               | 10 ++++++++++
 3 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/cockatrice/src/interface/widgets/tabs/tab_logs.cpp b/cockatrice/src/interface/widgets/tabs/tab_logs.cpp
index d5b704818..f73d06b57 100644
--- a/cockatrice/src/interface/widgets/tabs/tab_logs.cpp
+++ b/cockatrice/src/interface/widgets/tabs/tab_logs.cpp
@@ -185,6 +185,10 @@ void TabLog::createDock()
     if (canUseDeveloperCommands) {
         // Developers cannot query private conversations.
         privateChat->setVisible(false);
+        // The developer family ignores the IP filter server-side, so showing
+        // the field would silently unfilter the result by it. Hide it.
+        labelFindIPAddress->setVisible(false);
+        findIPAddress->setVisible(false);
     }
 
     pastDays = new QRadioButton(tr("Past X Days: "));
diff --git a/cockatrice/src/interface/widgets/tabs/tab_supervisor.cpp b/cockatrice/src/interface/widgets/tabs/tab_supervisor.cpp
index 1d4545255..c61fc0b82 100644
--- a/cockatrice/src/interface/widgets/tabs/tab_supervisor.cpp
+++ b/cockatrice/src/interface/widgets/tabs/tab_supervisor.cpp
@@ -845,8 +845,11 @@ void TabSupervisor::actTabLog(bool checked)
 void TabSupervisor::openTabLog()
 {
     // Developers query logs through the developer command family, so tell the
-    // tab which family to use.
-    const bool useDeveloperCommands = (userInfo->user_level() & ServerInfo_User::IsDeveloper) != 0;
+    // tab which family to use. The moderator family is strictly stronger, so a
+    // moderator who also holds the developer bit keeps the moderator path — the
+    // developer bit only selects the (narrowed) developer family on its own.
+    const bool useDeveloperCommands = (userInfo->user_level() & ServerInfo_User::IsDeveloper) &&
+                                      !(userInfo->user_level() & ServerInfo_User::IsModerator);
     tabLog = new TabLog(this, client, useDeveloperCommands);
     myAddTab(tabLog, aTabLog);
     connect(tabLog, &QObject::destroyed, this, [this] {
diff --git a/servatrice/src/serversocketinterface.cpp b/servatrice/src/serversocketinterface.cpp
index 7f49e272e..4b1502a15 100644
--- a/servatrice/src/serversocketinterface.cpp
+++ b/servatrice/src/serversocketinterface.cpp
@@ -1068,6 +1068,16 @@ Response::ResponseCode AbstractServerSocketInterface::cmdGetLogHistory(const Com
         }
     }
 
+    // For callers that must not see private conversations, never leave the
+    // target-type filter empty: if the request only asked for "chat" (or for
+    // nothing at all) the query below would carry no target_type restriction
+    // and would return every row, private messages included. Fall back to the
+    // game/room diagnostics the caller is allowed to see.
+    if (!allowPrivateChat && !gameType && !roomType) {
+        gameType = true;
+        roomType = true;
+    }
+
     int dateRange = cmd.date_range();
     int maximumResults = cmd.maximum_results();