Merge branch 'insp3' into master.

61 files changed, 380 insertions, 185 deletions

diff --git a/src/configparser.cpp b/src/configparser.cpp
index 7cd4b499b..2f124dee2 100644
--- a/src/configparser.cpp
+++ b/src/configparser.cpp
@@ -33,7 +33,10 @@ enum ParseFlags
 	FLAG_NO_EXEC = 2,
 
 	// All includes are disabled.
-	FLAG_NO_INC = 4
+	FLAG_NO_INC = 4,
+
+	// &env.FOO; is disabled.
+	FLAG_NO_ENV = 8
 };
 
 // Represents the position within a config file.
@@ -238,9 +241,13 @@ struct Parser
 				}
 				else if (varname.compare(0, 4, "env.") == 0)
 				{
+					if (flags & FLAG_NO_ENV)
+						throw CoreException("XML environment entity reference in file included with noenv=\"yes\"");
+
 					const char* envstr = getenv(varname.c_str() + 4);
 					if (!envstr)
 						throw CoreException("Undefined XML environment entity reference '&" + varname + ";'");
+
 					value.append(envstr);
 				}
 				else
@@ -388,6 +395,8 @@ void ParseStack::DoInclude(ConfigTag* tag, int flags)
 			flags |= FLAG_NO_INC;
 		if (tag->getBool("noexec", false))
 			flags |= FLAG_NO_EXEC;
+		if (tag->getBool("noenv", false))
+			flags |= FLAG_NO_ENV;
 
 		if (!ParseFile(ServerInstance->Config->Paths.PrependConfig(name), flags, mandatorytag))
 			throw CoreException("Included");
@@ -398,13 +407,15 @@ void ParseStack::DoInclude(ConfigTag* tag, int flags)
 			flags |= FLAG_NO_INC;
 		if (tag->getBool("noexec", false))
 			flags |= FLAG_NO_EXEC;
+		if (tag->getBool("noenv", false))
+			flags |= FLAG_NO_ENV;
 
 		const std::string includedir = ServerInstance->Config->Paths.PrependConfig(name);
 		std::vector<std::string> files;
 		if (!FileSystem::GetFileList(includedir, files, "*.conf"))
 			throw CoreException("Unable to read directory for include: " + includedir);
 
-		std::sort(files.begin(), files.end()); 
+		std::sort(files.begin(), files.end());
 		for (std::vector<std::string>::const_iterator iter = files.begin(); iter != files.end(); ++iter)
 		{
 			const std::string path = includedir + '/' + *iter;
@@ -420,6 +431,8 @@ void ParseStack::DoInclude(ConfigTag* tag, int flags)
 			flags |= FLAG_NO_INC;
 		if (tag->getBool("noexec", true))
 			flags |= FLAG_NO_EXEC;
+		if (tag->getBool("noenv", true))
+			flags |= FLAG_NO_ENV;
 
 		if (!ParseFile(name, flags, mandatorytag, true))
 			throw CoreException("Included");
diff --git a/src/configreader.cpp b/src/configreader.cpp
index b9bca0443..dd7b4277f 100644
--- a/src/configreader.cpp
+++ b/src/configreader.cpp
@@ -53,10 +53,10 @@ ServerLimits::ServerLimits(ConfigTag* tag)
 }
 
 ServerConfig::ServerPaths::ServerPaths(ConfigTag* tag)
-	: Config(tag->getString("configdir", INSPIRCD_CONFIG_PATH))
-	, Data(tag->getString("datadir", INSPIRCD_DATA_PATH))
-	, Log(tag->getString("logdir", INSPIRCD_LOG_PATH))
-	, Module(tag->getString("moduledir", INSPIRCD_MODULE_PATH))
+	: Config(tag->getString("configdir", INSPIRCD_CONFIG_PATH, 1))
+	, Data(tag->getString("datadir", INSPIRCD_DATA_PATH, 1))
+	, Log(tag->getString("logdir", INSPIRCD_LOG_PATH, 1))
+	, Module(tag->getString("moduledir", INSPIRCD_MODULE_PATH, 1))
 {
 }
 
@@ -378,9 +378,9 @@ void ServerConfig::Fill()
 	CCOnConnect = ConfValue("performance")->getBool("clonesonconnect", true);
 	MaxConn = ConfValue("performance")->getUInt("somaxconn", SOMAXCONN);
 	TimeSkipWarn = ConfValue("performance")->getDuration("timeskipwarn", 2, 0, 30);
-	XLineMessage = options->getString("xlinemessage", "You're banned!");
-	ServerDesc = server->getString("description", "Configure Me");
-	Network = server->getString("network", "Network");
+	XLineMessage = options->getString("xlinemessage", "You're banned!", 1);
+	ServerDesc = server->getString("description", "Configure Me", 1);
+	Network = server->getString("network", "Network", 1);
 	NetBufferSize = ConfValue("performance")->getInt("netbuffersize", 10240, 1024, 65534);
 	CustomVersion = security->getString("customversion");
 	HideBans = security->getBool("hidebans");
@@ -419,7 +419,7 @@ void ServerConfig::Fill()
 	ReadXLine(this, "badhost", "host", ServerInstance->XLines->GetFactory("K"));
 	ReadXLine(this, "exception", "host", ServerInstance->XLines->GetFactory("E"));
 
-	const std::string restrictbannedusers = options->getString("restrictbannedusers", "yes");
+	const std::string restrictbannedusers = options->getString("restrictbannedusers", "yes", 1);
 	if (stdalgo::string::equalsci(restrictbannedusers, "no"))
 		RestrictBannedUsers = ServerConfig::BUT_NORMAL;
 	else if (stdalgo::string::equalsci(restrictbannedusers, "silent"))
diff --git a/src/coremods/core_channel/core_channel.cpp b/src/coremods/core_channel/core_channel.cpp
index 92ad83315..ef57978a6 100644
--- a/src/coremods/core_channel/core_channel.cpp
+++ b/src/coremods/core_channel/core_channel.cpp
@@ -175,7 +175,7 @@ class CoreModChannel
 		}
 
 		ConfigTag* securitytag = ServerInstance->Config->ConfValue("security");
-		const std::string announceinvites = securitytag->getString("announceinvites", "dynamic");
+		const std::string announceinvites = securitytag->getString("announceinvites", "dynamic", 1);
 		Invite::AnnounceState newannouncestate;
 		if (stdalgo::string::equalsci(announceinvites, "none"))
 			newannouncestate = Invite::ANNOUNCE_NONE;
diff --git a/src/coremods/core_dns.cpp b/src/coremods/core_dns.cpp
index b19d80b49..1f72489b5 100644
--- a/src/coremods/core_dns.cpp
+++ b/src/coremods/core_dns.cpp
@@ -706,8 +706,8 @@ class MyManager : public Manager, public Timer, public EventHandler
 			SocketEngine::Shutdown(this, 2);
 			SocketEngine::Close(this);
 
-			/* Remove expired entries from the cache */
-			this->Tick(ServerInstance->Time());
+			// Remove all entries from the cache.
+			cache.clear();
 		}
 
 		irc::sockets::aptosa(dnsserver, DNS::PORT, myserver);
diff --git a/src/coremods/core_hostname_lookup.cpp b/src/coremods/core_hostname_lookup.cpp
index f0d54e975..9fb4ec19b 100644
--- a/src/coremods/core_hostname_lookup.cpp
+++ b/src/coremods/core_hostname_lookup.cpp
@@ -136,7 +136,8 @@ class UserResolver : public DNS::Request
 			if (rev_match)
 			{
 				bound_user->WriteNotice("*** Found your hostname (" + this->question.name + (r->cached ? ") -- cached" : ")"));
-				bound_user->ChangeRealHost(this->question.name, true);
+				bool display_is_real = bound_user->GetDisplayedHost() == bound_user->GetRealHost();
+				bound_user->ChangeRealHost(this->question.name, display_is_real);
 				dl->unset(bound_user);
 			}
 			else
diff --git a/src/coremods/core_info/cmd_info.cpp b/src/coremods/core_info/cmd_info.cpp
index e17cc6bd7..c4e9464d8 100644
--- a/src/coremods/core_info/cmd_info.cpp
+++ b/src/coremods/core_info/cmd_info.cpp
@@ -38,17 +38,18 @@ static const char* const lines[] = {
 	"                 November 2002 - Present",
 	" ",
 	"\002Core Developers\002:",
-	"    Attila Molnar,          Attila,     <attilamolnar@hush.com>",
+	"    Matt Schatz,            genius3000, <genius3000@g3k.solutions>",
 	"    Sadie Powell,           SadieCat,   <sadie@witchery.services>",
 	" ",
 	"\002Former Developers\002:",
-	"    Oliver Lupton,          Om,         <om@inspircd.org>",
-	"    John Brooks,            Special,    <special@inspircd.org>",
+	"    Attila Molnar,          Attila,     <attilamolnar@hush.com>",
+	"    Daniel De Graaf,        danieldg,   <danieldg@inspircd.org>",
 	"    Dennis Friis,           peavey,     <peavey@inspircd.org>",
+	"    John Brooks,            Special,    <special@inspircd.org>",
+	"    Matt Smith,             dz,         <dz@inspircd.org>",
+	"    Oliver Lupton,          Om,         <om@inspircd.org>",
 	"    Thomas Stagner,         aquanight,  <aquanight@inspircd.org>",
 	"    Uli Schlachter,         psychon,    <psychon@inspircd.org>",
-	"    Matt Smith,             dz,         <dz@inspircd.org>",
-	"    Daniel De Graaf,        danieldg,   <danieldg@inspircd.org>",
 	" ",
 	"\002Founding Developers\002:",
 	"    Craig Edwards,          Brain,      <brain@inspircd.org>",
@@ -56,22 +57,22 @@ static const char* const lines[] = {
 	"    Robin Burchell,         w00t,       <w00t@inspircd.org>",
 	" ",
 	"\002Active Contributors\002:",
-	"    Adam           linuxdaemon     Sheogorath",
+	"   Adam            linuxdaemon     Robby           Sheogorath",
 	" ",
 	"\002Former Contributors\002:",
-	"   dmb             Zaba            skenmy         GreenReaper",
-	"   Dan             Jason           satmd          owine",
-	"   Adremelech      John2           jilles         HiroP",
-	"   eggy            Bricker         AnMaster       djGrrr",
-	"   nenolod         Quension        praetorian     pippijn",
-	"   CC              jamie           typobox43      Burlex",
-	"   Stskeeps        ThaPrince       BuildSmart     Thunderhacker",
-	"   Skip            LeaChim         Majic          MacGyver",
-	"   Namegduf        Ankit           Phoenix        Taros",
-	"   jackmcbarn      ChrisTX         Shawn          Shutter",
+	"   Adremelech      Ankit           AnMaster        Bricker",
+	"   BuildSmart      Burlex          CC              ChrisTX",
+	"   Dan             djGrrr          dmb             eggy",
+	"   GreenReaper     HiroP           jackmcbarn      jamie",
+	"   Jason           jilles          John2           kaniini",
+	"   LeaChim         MacGyver        Majic           Namegduf",
+	"   owine           Phoenix         pippijn         praetorian",
+	"   Quension        satmd           Shawn           Shutter",
+	"   skenmy          Skip            Stskeeps        Taros",
+	"   ThaPrince       Thunderhacker   typobox43       Zaba",
 	" ",
 	"\002Thanks To\002:",
-	"   Asmo            Brik            fraggeln       genius3000",
+	"   Asmo            Brik            fraggeln        prawnsalad",
 	" ",
 	" Best experienced with: \002An IRC client\002",
 	NULL
diff --git a/src/coremods/core_info/cmd_motd.cpp b/src/coremods/core_info/cmd_motd.cpp
index f0b9fee95..69caf7de1 100644
--- a/src/coremods/core_info/cmd_motd.cpp
+++ b/src/coremods/core_info/cmd_motd.cpp
@@ -48,7 +48,8 @@ CmdResult CommandMotd::Handle(User* user, const Params& parameters)
 	LocalUser* localuser = IS_LOCAL(user);
 	if (localuser)
 		tag = localuser->GetClass()->config;
-	std::string motd_name = tag->getString("motd", "motd");
+
+	const std::string motd_name = tag->getString("motd", "motd", 1);
 	ConfigFileCache::iterator motd = motds.find(motd_name);
 	if (motd == motds.end())
 	{
diff --git a/src/coremods/core_list.cpp b/src/coremods/core_list.cpp
index 0b190aa59..96b521d23 100644
--- a/src/coremods/core_list.cpp
+++ b/src/coremods/core_list.cpp
@@ -48,8 +48,9 @@ class CommandList : public Command
 	}
 
  public:
-	/** Constructor for list.
-	 */
+	// Whether to show modes in the LIST response.
+	bool showmodes;
+
 	CommandList(Module* parent)
 		: Command(parent,"LIST", 0, 0)
 		, secretmode(creator, "secret")
@@ -186,11 +187,16 @@ CmdResult CommandList::Handle(User* user, const Params& parameters)
 				// Channel is private (+p) and user is outside/not privileged
 				user->WriteNumeric(RPL_LIST, '*', users, "");
 			}
-			else
+			else if (showmodes)
 			{
-				/* User is in the channel/privileged, channel is not +s */
+				// Show the list response with the modes and topic.
 				user->WriteNumeric(RPL_LIST, chan->name, users, InspIRCd::Format("[+%s] %s", chan->ChanModes(n), chan->topic.c_str()));
 			}
+			else
+			{
+				// Show the list response with just the modes.
+				user->WriteNumeric(RPL_LIST, chan->name, users, chan->topic);
+			}
 		}
 	}
 	user->WriteNumeric(RPL_LISTEND, "End of channel list.");
@@ -212,6 +218,12 @@ class CoreModList
 	{
 	}
 
+	void ReadConfig(ConfigStatus& status) override
+	{
+		ConfigTag* tag = ServerInstance->Config->ConfValue("options");
+		cmd.showmodes = tag->getBool("modesinlist");
+	}
+
 	void OnBuildISupport(ISupport::TokenMap& tokens) override
 	{
 		tokens["ELIST"] = "CMNTU";
diff --git a/src/coremods/core_lusers.cpp b/src/coremods/core_lusers.cpp
index 5cb8bc4fb..1075d406f 100644
--- a/src/coremods/core_lusers.cpp
+++ b/src/coremods/core_lusers.cpp
@@ -39,7 +39,7 @@ struct LusersCounters
 		for (user_hash::const_iterator i = users.begin(); i != users.end(); ++i)
 		{
 			User* u = i->second;
-			if (u->IsModeSet(invisiblemode))
+			if (!u->server->IsULine() && u->IsModeSet(invisiblemode))
 				invisible++;
 		}
 	}
@@ -127,6 +127,9 @@ public:
 		if (dest->registered != REG_ALL)
 			return;
 
+		if (dest->server->IsULine())
+			return;
+
 		if (adding)
 			invisible++;
 		else
@@ -153,13 +156,13 @@ class ModuleLusers : public Module
 	void OnPostConnect(User* user) override
 	{
 		counters.UpdateMaxUsers();
-		if (user->IsModeSet(invisiblemode))
+		if (!user->server->IsULine() && user->IsModeSet(invisiblemode))
 			counters.invisible++;
 	}
 
 	void OnUserQuit(User* user, const std::string& message, const std::string& oper_message) override
 	{
-		if (user->IsModeSet(invisiblemode))
+		if (!user->server->IsULine() && user->IsModeSet(invisiblemode))
 			counters.invisible--;
 	}
 
diff --git a/src/coremods/core_message.cpp b/src/coremods/core_message.cpp
index aa018ae6f..bc4ab3662 100644
--- a/src/coremods/core_message.cpp
+++ b/src/coremods/core_message.cpp
@@ -408,7 +408,7 @@ class ModuleCoreMessage : public Module
 		if (chan->IsModeSet(noextmsgmode) && !chan->HasUser(user))
 		{
 			// The noextmsg mode is set and the user is not in the channel.
-			user->WriteNumeric(ERR_CANNOTSENDTOCHAN, chan->name, "Cannot send to channel (no external messages)");
+			user->WriteNumeric(Numerics::CannotSendTo(chan, "external messages", *noextmsgmode));
 			return MOD_RES_DENY;
 		}
 
@@ -416,7 +416,7 @@ class ModuleCoreMessage : public Module
 		if (no_chan_priv && chan->IsModeSet(moderatedmode))
 		{
 			// The moderated mode is set and the user has no status rank.
-			user->WriteNumeric(ERR_CANNOTSENDTOCHAN, chan->name, "Cannot send to channel (+m is set)");
+			user->WriteNumeric(Numerics::CannotSendTo(chan, "messages", *moderatedmode));
 			return MOD_RES_DENY;
 		}
 
@@ -424,7 +424,7 @@ class ModuleCoreMessage : public Module
 		{
 			// The user is banned in the channel and restrictbannedusers is enabled.
 			if (ServerInstance->Config->RestrictBannedUsers == ServerConfig::BUT_RESTRICT_NOTIFY)
-				user->WriteNumeric(ERR_CANNOTSENDTOCHAN, chan->name, "Cannot send to channel (you're banned)");
+				user->WriteNumeric(Numerics::CannotSendTo(chan, "You cannot send messages to this channel whilst banned."));
 			return MOD_RES_DENY;
 		}
 
diff --git a/src/coremods/core_oper/cmd_oper.cpp b/src/coremods/core_oper/cmd_oper.cpp
index 7b85f05db..9a678165f 100644
--- a/src/coremods/core_oper/cmd_oper.cpp
+++ b/src/coremods/core_oper/cmd_oper.cpp
@@ -65,7 +65,8 @@ CmdResult CommandOper::HandleLocal(LocalUser* user, const Params& parameters)
 	if (!match_pass)
 		fields.append("password ");
 	if (!match_hosts)
-		fields.append("hosts");
+		fields.append("hosts ");
+	fields.erase(fields.length() - 1, 1);
 
 	// tell them they suck, and lag them up to help prevent brute-force attacks
 	user->WriteNumeric(ERR_NOOPERHOST, "Invalid oper credentials");
diff --git a/src/coremods/core_stats.cpp b/src/coremods/core_stats.cpp
index f3ca4b0c8..14c38f253 100644
--- a/src/coremods/core_stats.cpp
+++ b/src/coremods/core_stats.cpp
@@ -117,8 +117,8 @@ void CommandStats::DoStats(Stats::Context& stats)
 			for (std::vector<ListenSocket*>::const_iterator i = ServerInstance->ports.begin(); i != ServerInstance->ports.end(); ++i)
 			{
 				ListenSocket* ls = *i;
-				std::string type = ls->bind_tag->getString("type", "clients");
-				std::string hook = ls->bind_tag->getString("ssl", "plaintext");
+				const std::string type = ls->bind_tag->getString("type", "clients", 1);
+				const std::string hook = ls->bind_tag->getString("ssl", "plaintext", 1);
 
 				stats.AddRow(249, ls->bind_sa.str() + " (" + type + ", " + hook + ")");
 			}
@@ -149,7 +149,7 @@ void CommandStats::DoStats(Stats::Context& stats)
 				else
 					param.append(c->host);
 
-				row.push(param).push(c->config->getString("port", "*"));
+				row.push(param).push(c->config->getString("port", "*", 1));
 				row.push(ConvToStr(c->GetRecvqMax())).push(ConvToStr(c->GetSendqSoftMax())).push(ConvToStr(c->GetSendqHardMax())).push(ConvToStr(c->GetCommandRate()));
 
 				param = ConvToStr(c->GetPenaltyThreshold());
diff --git a/src/coremods/core_whois.cpp b/src/coremods/core_whois.cpp
index 78ae78d39..2bf3ea778 100644
--- a/src/coremods/core_whois.cpp
+++ b/src/coremods/core_whois.cpp
@@ -364,7 +364,7 @@ class CoreModWhois : public Module
 	void ReadConfig(ConfigStatus&) override
 	{
 		ConfigTag* tag = ServerInstance->Config->ConfValue("options");
-		const std::string splitwhois = tag->getString("splitwhois", "no");
+		const std::string splitwhois = tag->getString("splitwhois", "no", 1);
 		SplitWhoisState newsplitstate;
 		if (stdalgo::string::equalsci(splitwhois, "no"))
 			newsplitstate = SPLITWHOIS_NONE;
diff --git a/src/coremods/core_whowas.cpp b/src/coremods/core_whowas.cpp
index 3647d0081..02820aa7b 100644
--- a/src/coremods/core_whowas.cpp
+++ b/src/coremods/core_whowas.cpp
@@ -25,7 +25,6 @@
 
 
 #include "inspircd.h"
-#include "commands/cmd_whowas.h"
 #include "modules/stats.h"
 
 enum
@@ -38,6 +37,152 @@ enum
 	RPL_WHOWASIP = 652
 };
 
+namespace WhoWas
+{
+	/** One entry for a nick. There may be multiple entries for a nick. */
+	struct Entry
+	{
+		/** Real host */
+		const std::string host;
+
+		/** Displayed host */
+		const std::string dhost;
+
+		/** Ident */
+		const std::string ident;
+
+		/** Server name */
+		const std::string server;
+
+		/** Real name */
+		const std::string real;
+
+		/** Signon time */
+		const time_t signon;
+
+		/** Initialize this Entry with a user */
+		Entry(User* user);
+	};
+
+	/** Everything known about one nick */
+	struct Nick : public insp::intrusive_list_node<Nick>
+	{
+		/** A group of users related by nickname */
+		typedef std::deque<Entry*> List;
+
+		/** Container where each element has information about one occurrence of this nick */
+		List entries;
+
+		/** Time this nick was added to the database */
+		const time_t addtime;
+
+		/** Nickname whose information is stored in this class */
+		const std::string nick;
+
+		/** Constructor to initialize fields */
+		Nick(const std::string& nickname);
+
+		/** Destructor, deallocates all elements in the entries container */
+		~Nick();
+	};
+
+	class Manager
+	{
+	 public:
+		struct Stats
+		{
+			/** Number of currently existing WhoWas::Entry objects */
+			size_t entrycount;
+		};
+
+		/** Add a user to the whowas database. Called when a user quits.
+		 * @param user The user to add to the database
+		 */
+		void Add(User* user);
+
+		/** Retrieves statistics about the whowas database
+		 * @return Whowas statistics as a WhoWas::Manager::Stats struct
+		 */
+		Stats GetStats() const;
+
+		/** Expires old entries */
+		void Maintain();
+
+		/** Updates the current configuration which may result in the database being pruned if the
+		 * new values are lower than the current ones.
+		 * @param NewGroupSize Maximum number of nicks allowed in the database. In case there are this many nicks
+		 * in the database and one more is added, the oldest one is removed (FIFO).
+		 * @param NewMaxGroups Maximum number of entries per nick
+		 * @param NewMaxKeep Seconds how long each nick should be kept
+		 */
+		void UpdateConfig(unsigned int NewGroupSize, unsigned int NewMaxGroups, unsigned int NewMaxKeep);
+
+		/** Retrieves all data known about a given nick
+		 * @param nick Nickname to find, case insensitive (IRC casemapping)
+		 * @return A pointer to a WhoWas::Nick if the nick was found, NULL otherwise
+		 */
+		const Nick* FindNick(const std::string& nick) const;
+
+		/** Returns true if WHOWAS is enabled according to the current configuration
+		 * @return True if WHOWAS is enabled according to the configuration, false if WHOWAS is disabled
+		 */
+		bool IsEnabled() const;
+
+		/** Constructor */
+		Manager();
+
+		/** Destructor */
+		~Manager();
+
+	 private:
+		/** Order in which the users were added into the map, used to remove oldest nick */
+		typedef insp::intrusive_list_tail<Nick> FIFO;
+
+		/** Sets of users in the whowas system */
+		typedef std::unordered_map<std::string, WhoWas::Nick*, irc::insensitive, irc::StrHashComp> whowas_users;
+
+		/** Primary container, links nicknames tracked by WHOWAS to a list of records */
+		whowas_users whowas;
+
+		/** List of nicknames in the order they were inserted into the map */
+		FIFO whowas_fifo;
+
+		/** Max number of WhoWas entries per user. */
+		unsigned int GroupSize;
+
+		/** Max number of cumulative user-entries in WhoWas.
+		 * When max reached and added to, push out oldest entry FIFO style.
+		 */
+		unsigned int MaxGroups;
+
+		/** Max seconds a user is kept in WhoWas before being pruned. */
+		unsigned int MaxKeep;
+
+		/** Shrink all data structures to honor the current settings */
+		void Prune();
+
+		/** Remove a nick (and all entries belonging to it) from the database
+		 * @param it Iterator to the nick to purge
+		 */
+		void PurgeNick(whowas_users::iterator it);
+
+		/** Remove a nick (and all entries belonging to it) from the database
+		 * @param nick Nick to purge
+		 */
+		void PurgeNick(WhoWas::Nick* nick);
+	};
+}
+
+class CommandWhowas : public Command
+{
+  public:
+	// Manager handling all whowas database related tasks
+	WhoWas::Manager manager;
+
+	CommandWhowas(Module* parent);
+	CmdResult Handle(User* user, const Params& parameters) override;
+};
+
 CommandWhowas::CommandWhowas( Module* parent)
 	: Command(parent, "WHOWAS", 1)
 {
diff --git a/src/inspircd.cpp b/src/inspircd.cpp
index 38f23cc2f..df397caab 100644
--- a/src/inspircd.cpp
+++ b/src/inspircd.cpp
@@ -141,7 +141,7 @@ namespace
 		if (!ServerInstance->Config->TimeSkipWarn)
 			return;
 
-		time_t timediff = oldtime - newtime;
+		time_t timediff = newtime - oldtime;
 
 		if (timediff > ServerInstance->Config->TimeSkipWarn)
 			ServerInstance->SNO.WriteToSnoMask('a', "\002Performance warning!\002 Server clock jumped forwards by %lu seconds!", timediff);
diff --git a/src/inspsocket.cpp b/src/inspsocket.cpp
index 1a1ca6a5e..f73c48560 100644
--- a/src/inspsocket.cpp
+++ b/src/inspsocket.cpp
@@ -49,7 +49,7 @@ BufferedSocket::BufferedSocket(int newfd)
 	Timeout = NULL;
 	this->fd = newfd;
 	this->state = I_CONNECTED;
-	if (fd > -1)
+	if (HasFd())
 		SocketEngine::AddFd(this, FD_WANT_FAST_READ | FD_WANT_EDGE_WRITE);
 }
 
@@ -66,10 +66,10 @@ void BufferedSocket::DoConnect(const irc::sockets::sockaddrs& dest, const irc::s
 
 BufferedSocketError BufferedSocket::BeginConnect(const irc::sockets::sockaddrs& dest, const irc::sockets::sockaddrs& bind, unsigned int timeout)
 {
-	if (fd < 0)
+	if (!HasFd())
 		fd = socket(dest.family(), SOCK_STREAM, 0);
 
-	if (fd < 0)
+	if (!HasFd())
 		return I_ERR_SOCKET;
 
 	if (bind.family() != 0)
@@ -104,7 +104,7 @@ void StreamSocket::Close()
 		return;
 
 	closing = true;
-	if (this->fd > -1)
+	if (HasFd())
 	{
 		// final chance, dump as much of the sendq as we can
 		DoWrite();
@@ -229,7 +229,7 @@ void StreamSocket::DoWrite()
 
 		return;
 	}
-	if (!error.empty() || fd < 0)
+	if (!error.empty() || !HasFd())
 	{
 		ServerInstance->Logs.Log("SOCKET", LOG_DEBUG, "DoWrite on errored or closed socket");
 		return;
@@ -369,7 +369,7 @@ bool StreamSocket::OnSetEndPoint(const irc::sockets::sockaddrs& local, const irc
 
 void StreamSocket::WriteData(const std::string &data)
 {
-	if (fd < 0)
+	if (!HasFd())
 	{
 		ServerInstance->Logs.Log("SOCKET", LOG_DEBUG, "Attempt to write data to dead socket: %s",
 			data.c_str());
diff --git a/src/listensocket.cpp b/src/listensocket.cpp
index 482bd9b12..a69aace99 100644
--- a/src/listensocket.cpp
+++ b/src/listensocket.cpp
@@ -83,6 +83,11 @@ ListenSocket::ListenSocket(ConfigTag* tag, const irc::sockets::sockaddrs& bind_t
 #endif
 	}
 
+	SocketEngine::SetReuse(fd);
+	int rv = SocketEngine::Bind(this->fd, bind_to);
+	if (rv >= 0)
+		rv = SocketEngine::Listen(this->fd, ServerInstance->Config->MaxConn);
+
 	if (bind_to.family() == AF_UNIX)
 	{
 		const std::string permissionstr = tag->getString("permissions");
@@ -91,11 +96,6 @@ ListenSocket::ListenSocket(ConfigTag* tag, const irc::sockets::sockaddrs& bind_t
 			chmod(bind_to.str().c_str(), permissions);
 	}
 
-	SocketEngine::SetReuse(fd);
-	int rv = SocketEngine::Bind(this->fd, bind_to);
-	if (rv >= 0)
-		rv = SocketEngine::Listen(this->fd, ServerInstance->Config->MaxConn);
-
 	// Default defer to on for TLS listeners because in TLS the client always speaks first
 	int timeout = tag->getDuration("defer", (tag->getString("ssl").empty() ? 0 : 3));
 	if (timeout && !rv)
@@ -207,7 +207,7 @@ void ListenSocket::OnEventHandlerRead()
 	FIRST_MOD_RESULT(OnAcceptConnection, res, (incomingSockfd, this, &client, &server));
 	if (res == MOD_RES_PASSTHRU)
 	{
-		std::string type = bind_tag->getString("type", "clients");
+		const std::string type = bind_tag->getString("type", "clients", 1);
 		if (stdalgo::string::equalsci(type, "clients"))
 		{
 			ServerInstance->Users.AddUser(incomingSockfd, this, &client, &server);
diff --git a/src/modules.cpp b/src/modules.cpp
index 28729ba63..eb33267de 100644
--- a/src/modules.cpp
+++ b/src/modules.cpp
@@ -613,12 +613,13 @@ ServiceProvider* ModuleManager::FindService(ServiceType type, const std::string&
 
 std::string ModuleManager::ExpandModName(const std::string& modname)
 {
-	// Transform "callerid" -> "m_callerid.so" unless it already has a ".so" extension,
-	// so coremods in the "core_*.so" form aren't changed
-	std::string ret = modname;
-	if ((modname.length() < 3) || (modname.compare(modname.size() - 3, 3, ".so")))
-		ret.insert(0, "m_").append(".so");
-	return ret;
+	std::string fullname;
+	if (modname.compare(0, 5, "core_") != 0 && modname.compare(0, 2, "m_") != 0)
+		fullname.append("m_");
+	fullname.append(modname);
+	if (modname.length() < 3 || modname.compare(modname.size() - 3, 3, ".so") != 0)
+		fullname.append(".so");
+	return fullname;
 }
 
 dynamic_reference_base::dynamic_reference_base(Module* Creator, const std::string& Name)
diff --git a/src/modules/extra/m_geo_maxmind.cpp b/src/modules/extra/m_geo_maxmind.cpp
index 74beea547..cdd3424a6 100644
--- a/src/modules/extra/m_geo_maxmind.cpp
+++ b/src/modules/extra/m_geo_maxmind.cpp
@@ -160,7 +160,7 @@ class ModuleGeoMaxMind : public Module
 	void ReadConfig(ConfigStatus& status) override
 	{
 		ConfigTag* tag = ServerInstance->Config->ConfValue("maxmind");
-		const std::string file = ServerInstance->Config->Paths.PrependConfig(tag->getString("file", "GeoLite2-Country.mmdb"));
+		const std::string file = ServerInstance->Config->Paths.PrependConfig(tag->getString("file", "GeoLite2-Country.mmdb", 1));
 
 		// Try to read the new database.
 		MMDB_s mmdb;
@@ -179,7 +179,7 @@ class ModuleGeoMaxMind : public Module
 	void OnGarbageCollect() override
 	{
 		for (LocationMap::iterator iter = geoapi.locations.begin(); iter != geoapi.locations.end(); )
-		{	
+		{
 			Geolocation::Location* location = iter->second;
 			if (location->GetUseCount())
 			{
diff --git a/src/modules/extra/m_regex_pcre.cpp b/src/modules/extra/m_regex_pcre.cpp
index 0debc059e..85378ef48 100644
--- a/src/modules/extra/m_regex_pcre.cpp
+++ b/src/modules/extra/m_regex_pcre.cpp
@@ -28,7 +28,7 @@
 
 /// $PackageInfo: require_system("arch") pcre
 /// $PackageInfo: require_system("centos") pcre-devel
-/// $PackageInfo: require_system("darwin") pcre 
+/// $PackageInfo: require_system("darwin") pcre
 /// $PackageInfo: require_system("debian") libpcre3-dev
 /// $PackageInfo: require_system("ubuntu") libpcre3-dev
 
diff --git a/src/modules/extra/m_ssl_gnutls.cpp b/src/modules/extra/m_ssl_gnutls.cpp
index 42192325c..80185d982 100644
--- a/src/modules/extra/m_ssl_gnutls.cpp
+++ b/src/modules/extra/m_ssl_gnutls.cpp
@@ -548,12 +548,12 @@ namespace GnuTLS
 
 			Config(const std::string& profilename, ConfigTag* tag)
 				: name(profilename)
-				, certstr(ReadFile(tag->getString("certfile", "cert.pem")))
-				, keystr(ReadFile(tag->getString("keyfile", "key.pem")))
-				, dh(DHParams::Import(ReadFile(tag->getString("dhfile", "dhparams.pem"))))
+				, certstr(ReadFile(tag->getString("certfile", "cert.pem", 1)))
+				, keystr(ReadFile(tag->getString("keyfile", "key.pem", 1)))
+				, dh(DHParams::Import(ReadFile(tag->getString("dhfile", "dhparams.pem", 1))))
 				, priostr(GetPrioStr(profilename, tag))
 				, mindh(tag->getUInt("mindhbits", 1024))
-				, hashstr(tag->getString("hash", "md5"))
+				, hashstr(tag->getString("hash", "md5", 1))
 				, requestclientcert(tag->getBool("requestclientcert", true))
 			{
 				// Load trusted CA and revocation list, if set
diff --git a/src/modules/extra/m_ssl_mbedtls.cpp b/src/modules/extra/m_ssl_mbedtls.cpp
index 0cce2626a..734b83d8d 100644
--- a/src/modules/extra/m_ssl_mbedtls.cpp
+++ b/src/modules/extra/m_ssl_mbedtls.cpp
@@ -419,13 +419,13 @@ namespace mbedTLS
 			Config(const std::string& profilename, ConfigTag* tag, CTRDRBG& ctr_drbg)
 				: name(profilename)
 				, ctrdrbg(ctr_drbg)
-				, certstr(ReadFile(tag->getString("certfile", "cert.pem")))
-				, keystr(ReadFile(tag->getString("keyfile", "key.pem")))
-				, dhstr(ReadFile(tag->getString("dhfile", "dhparams.pem")))
+				, certstr(ReadFile(tag->getString("certfile", "cert.pem", 1)))
+				, keystr(ReadFile(tag->getString("keyfile", "key.pem", 1)))
+				, dhstr(ReadFile(tag->getString("dhfile", "dhparams.pem", 1)))
 				, ciphersuitestr(tag->getString("ciphersuites"))
 				, curvestr(tag->getString("curves"))
 				, mindh(tag->getUInt("mindhbits", 2048))
-				, hashstr(tag->getString("hash", "sha256"))
+				, hashstr(tag->getString("hash", "sha256", 1))
 				, castr(tag->getString("cafile"))
 				, minver(tag->getUInt("minver", 0))
 				, maxver(tag->getUInt("maxver", 0))
diff --git a/src/modules/extra/m_ssl_openssl.cpp b/src/modules/extra/m_ssl_openssl.cpp
index b7916b857..f15a16a4c 100644
--- a/src/modules/extra/m_ssl_openssl.cpp
+++ b/src/modules/extra/m_ssl_openssl.cpp
@@ -343,7 +343,7 @@ namespace OpenSSL
 	 public:
 		Profile(const std::string& profilename, ConfigTag* tag)
 			: name(profilename)
-			, dh(ServerInstance->Config->Paths.PrependConfig(tag->getString("dhfile", "dhparams.pem")))
+			, dh(ServerInstance->Config->Paths.PrependConfig(tag->getString("dhfile", "dhparams.pem", 1)))
 			, ctx(SSL_CTX_new(SSLv23_server_method()))
 			, clictx(SSL_CTX_new(SSLv23_client_method()))
 			, allowrenego(tag->getBool("renegotiation")) // Disallow by default
@@ -352,7 +352,7 @@ namespace OpenSSL
 			if ((!ctx.SetDH(dh)) || (!clictx.SetDH(dh)))
 				throw Exception("Couldn't set DH parameters");
 
-			std::string hash = tag->getString("hash", "md5");
+			const std::string hash = tag->getString("hash", "md5", 1);
 			digest = EVP_get_digestbyname(hash.c_str());
 			if (digest == NULL)
 				throw Exception("Unknown hash type " + hash);
@@ -368,7 +368,7 @@ namespace OpenSSL
 			}
 
 #ifndef OPENSSL_NO_ECDH
-			std::string curvename = tag->getString("ecdhcurve", "prime256v1");
+			const std::string curvename = tag->getString("ecdhcurve", "prime256v1", 1);
 			if (!curvename.empty())
 				ctx.SetECDH(curvename);
 #endif
@@ -379,14 +379,14 @@ namespace OpenSSL
 			/* Load our keys and certificates
 			 * NOTE: OpenSSL's error logging API sucks, don't blame us for this clusterfuck.
 			 */
-			std::string filename = ServerInstance->Config->Paths.PrependConfig(tag->getString("certfile", "cert.pem"));
+			std::string filename = ServerInstance->Config->Paths.PrependConfig(tag->getString("certfile", "cert.pem", 1));
 			if ((!ctx.SetCerts(filename)) || (!clictx.SetCerts(filename)))
 			{
 				ERR_print_errors_cb(error_callback, this);
 				throw Exception("Can't read certificate file: " + lasterr);
 			}
 
-			filename = ServerInstance->Config->Paths.PrependConfig(tag->getString("keyfile", "key.pem"));
+			filename = ServerInstance->Config->Paths.PrependConfig(tag->getString("keyfile", "key.pem", 1));
 			if ((!ctx.SetPrivateKey(filename)) || (!clictx.SetPrivateKey(filename)))
 			{
 				ERR_print_errors_cb(error_callback, this);
@@ -394,7 +394,7 @@ namespace OpenSSL
 			}
 
 			// Load the CAs we trust
-			filename = ServerInstance->Config->Paths.PrependConfig(tag->getString("cafile", "ca.pem"));
+			filename = ServerInstance->Config->Paths.PrependConfig(tag->getString("cafile", "ca.pem", 1));
 			if ((!ctx.SetCA(filename)) || (!clictx.SetCA(filename)))
 			{
 				ERR_print_errors_cb(error_callback, this);
@@ -402,9 +402,9 @@ namespace OpenSSL
 			}
 
 			// Load the CRLs.
-			std::string crlfile  = tag->getString("crlfile");
-			std::string crlpath  = tag->getString("crlpath");
-			std::string crlmode  = tag->getString("crlmode", "chain");
+			const std::string crlfile = tag->getString("crlfile");
+			const std::string crlpath = tag->getString("crlpath");
+			const std::string crlmode = tag->getString("crlmode", "chain", 1);
 			ctx.SetCRL(crlfile, crlpath, crlmode);
 
 			clictx.SetVerifyCert();
diff --git a/src/modules/m_anticaps.cpp b/src/modules/m_anticaps.cpp
index c57da330b..6b7236d91 100644
--- a/src/modules/m_anticaps.cpp
+++ b/src/modules/m_anticaps.cpp
@@ -175,7 +175,7 @@ class ModuleAntiCaps : public Module
 
 	void InformUser(Channel* channel, User* user, const std::string& message)
 	{
-		user->WriteNumeric(ERR_CANNOTSENDTOCHAN, channel->name, message + " and was blocked.");
+		user->WriteNumeric(Numerics::CannotSendTo(channel, message + " and was blocked."));
 	}
 
  public:
@@ -190,7 +190,7 @@ class ModuleAntiCaps : public Module
 		ConfigTag* tag = ServerInstance->Config->ConfValue("anticaps");
 
 		uppercase.reset();
-		const std::string upper = tag->getString("uppercase", "ABCDEFGHIJKLMNOPQRSTUVWXYZ");
+		const std::string upper = tag->getString("uppercase", "ABCDEFGHIJKLMNOPQRSTUVWXYZ", 1);
 		for (std::string::const_iterator iter = upper.begin(); iter != upper.end(); ++iter)
 			uppercase.set(static_cast<unsigned char>(*iter));
 
diff --git a/src/modules/m_blockcolor.cpp b/src/modules/m_blockcolor.cpp
index 1c1122864..920ce63e3 100644
--- a/src/modules/m_blockcolor.cpp
+++ b/src/modules/m_blockcolor.cpp
@@ -70,8 +70,10 @@ class ModuleBlockColor
 					// Block all control codes except \001 for CTCP
 					if ((*i >= 0) && (*i < 32) && (*i != 1))
 					{
-						user->WriteNumeric(ERR_CANNOTSENDTOCHAN, c->name, InspIRCd::Format("Can't send colors to channel (%s)",
-							modeset ? "+c is set" : "you're extbanned"));
+						if (modeset)
+							user->WriteNumeric(Numerics::CannotSendTo(c, "messages containing formatting characters", &bc));
+						else
+							user->WriteNumeric(Numerics::CannotSendTo(c, "messages containing formatting characters", 'c', "nocolor"));
 						return MOD_RES_DENY;
 					}
 				}
diff --git a/src/modules/m_censor.cpp b/src/modules/m_censor.cpp
index c7fd1ace8..708ac5f8d 100644
--- a/src/modules/m_censor.cpp
+++ b/src/modules/m_censor.cpp
@@ -51,7 +51,6 @@ class ModuleCensor : public Module
 		if (!IS_LOCAL(user))
 			return MOD_RES_PASSTHRU;
 
-		int numeric = 0;
 		switch (target.type)
 		{
 			case MessageTarget::TYPE_USER:
@@ -59,8 +58,6 @@ class ModuleCensor : public Module
 				User* targuser = target.Get<User>();
 				if (!targuser->IsModeSet(cu))
 					return MOD_RES_PASSTHRU;
-
-				numeric = ERR_CANTSENDTOUSER;
 				break;
 			}
 
@@ -73,8 +70,6 @@ class ModuleCensor : public Module
 				ModResult result = CheckExemption::Call(exemptionprov, user, targchan, "censor");
 				if (result == MOD_RES_ALLOW)
 					return MOD_RES_PASSTHRU;
-
-				numeric = ERR_CANNOTSENDTOCHAN;
 				break;
 			}
 
@@ -89,7 +84,11 @@ class ModuleCensor : public Module
 			{
 				if (index->second.empty())
 				{
-					user->WriteNumeric(numeric, target.GetName(), "Your message contained a censored word (" + index->first + "), and was blocked");
+					const std::string msg = InspIRCd::Format("Your message to this channel contained a banned phrase (%s) and was blocked.", index->first.c_str());
+					if (target.type == MessageTarget::TYPE_CHANNEL)
+						user->WriteNumeric(Numerics::CannotSendTo(target.Get<Channel>(), msg));
+					else
+						user->WriteNumeric(Numerics::CannotSendTo(target.Get<User>(), msg));
 					return MOD_RES_DENY;
 				}
 
diff --git a/src/modules/m_chanfilter.cpp b/src/modules/m_chanfilter.cpp
index d2beec8d5..ac27b3117 100644
--- a/src/modules/m_chanfilter.cpp
+++ b/src/modules/m_chanfilter.cpp
@@ -129,9 +129,10 @@ class ModuleChanFilter : public Module
 		}
 
 		if (hidemask)
-			user->WriteNumeric(ERR_CANNOTSENDTOCHAN, chan->name, "Cannot send to channel (your part message contained a censored word)");
+			user->WriteNumeric(Numerics::CannotSendTo(chan, "Your part message contained a banned phrase and was blocked."));
 		else
-			user->WriteNumeric(ERR_CANNOTSENDTOCHAN, chan->name, "Cannot send to channel (your part message contained a censored word: " + match->mask + ")");
+			user->WriteNumeric(Numerics::CannotSendTo(chan, InspIRCd::Format("Your part message contained a banned phrase (%s) and was blocked.",
+				match->mask.c_str())));
 	}
 
 	ModResult OnUserPreMessage(User* user, const MessageTarget& target, MessageDetails& details) override
@@ -150,9 +151,10 @@ class ModuleChanFilter : public Module
 			}
 
 			if (hidemask)
-				user->WriteNumeric(ERR_CANNOTSENDTOCHAN, chan->name, "Cannot send to channel (your message contained a censored word)");
+				user->WriteNumeric(Numerics::CannotSendTo(chan, "Your message to this channel contained a banned phrase and was blocked."));
 			else
-				user->WriteNumeric(ERR_CANNOTSENDTOCHAN, chan->name, "Cannot send to channel (your message contained a censored word: " + match->mask + ")");
+				user->WriteNumeric(Numerics::CannotSendTo(chan, InspIRCd::Format("Your message to this channel contained a banned phrase (%s) and was blocked.",
+					match->mask.c_str())));
 
 			return MOD_RES_DENY;
 		}
diff --git a/src/modules/m_chghost.cpp b/src/modules/m_chghost.cpp
index 91d4fb2cc..a6887bfa6 100644
--- a/src/modules/m_chghost.cpp
+++ b/src/modules/m_chghost.cpp
@@ -98,10 +98,11 @@ class ModuleChgHost : public Module
 
 	void ReadConfig(ConfigStatus& status) override
 	{
-		std::string hmap = ServerInstance->Config->ConfValue("hostname")->getString("charmap", "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz.-_/0123456789");
+		ConfigTag* tag = ServerInstance->Config->ConfValue("hostname");
+		const std::string hmap = tag->getString("charmap", "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz.-_/0123456789", 1);
 
 		cmd.hostmap.reset();
-		for (std::string::iterator n = hmap.begin(); n != hmap.end(); n++)
+		for (std::string::const_iterator n = hmap.begin(); n != hmap.end(); n++)
 			cmd.hostmap.set(static_cast<unsigned char>(*n));
 	}
 
diff --git a/src/modules/m_codepage.cpp b/src/modules/m_codepage.cpp
index 86f3fd5dd..47a3cf28c 100644
--- a/src/modules/m_codepage.cpp
+++ b/src/modules/m_codepage.cpp
@@ -131,7 +131,7 @@ class ModuleCodepage
 			unsigned char begin = tag->getUInt("begin", tag->getUInt("index", 0), 1, UCHAR_MAX);
 			if (!begin)
 				throw ModuleException("<cpchars> tag without index or begin specified at " + tag->getTagLocation());
-	
+
 			unsigned char end = tag->getUInt("end", begin, 1, UCHAR_MAX);
 			if (begin > end)
 				throw ModuleException("<cpchars:begin> must be lower than <cpchars:end> at " + tag->getTagLocation());
diff --git a/src/modules/m_commonchans.cpp b/src/modules/m_commonchans.cpp
index d1786bc1e..e87a9b86f 100644
--- a/src/modules/m_commonchans.cpp
+++ b/src/modules/m_commonchans.cpp
@@ -43,7 +43,7 @@ class ModuleCommonChans
 		if (user->HasPrivPermission("users/ignore-commonchans") || user->server->IsULine())
 			return MOD_RES_PASSTHRU;
 
-		user->WriteNumeric(ERR_CANTSENDTOUSER, targuser->nick, "You are not permitted to send private messages to this user (+c is set)");
+		user->WriteNumeric(Numerics::CannotSendTo(targuser, "messages", &mode));
 		return MOD_RES_DENY;
 	}
 
diff --git a/src/modules/m_customtitle.cpp b/src/modules/m_customtitle.cpp
index 1f2748edb..4f963ea66 100644
--- a/src/modules/m_customtitle.cpp
+++ b/src/modules/m_customtitle.cpp
@@ -144,7 +144,7 @@ class ModuleCustomTitle : public Module, public Whois::LineEventListener
 					name.c_str(), tag->getTagLocation().c_str());
 			}
 
-			std::string host = tag->getString("host", "*@*");
+			std::string host = tag->getString("host", "*@*", 1);
 			std::string title = tag->getString("title");
 			std::string vhost = tag->getString("vhost");
 			CustomTitle config(name, pass, hash, host, title, vhost);
diff --git a/src/modules/m_delayjoin.cpp b/src/modules/m_delayjoin.cpp
index 3af432375..a32f412ab 100644
--- a/src/modules/m_delayjoin.cpp
+++ b/src/modules/m_delayjoin.cpp
@@ -78,7 +78,7 @@ class JoinHook : public ClientProtocol::EventHook
 
 }
 
-class ModuleDelayJoin 
+class ModuleDelayJoin
 	: public Module
 	, public CTCTags::EventListener
 	, public Names::EventListener
diff --git a/src/modules/m_delaymsg.cpp b/src/modules/m_delaymsg.cpp
index c0c9855fa..faf382081 100644
--- a/src/modules/m_delaymsg.cpp
+++ b/src/modules/m_delaymsg.cpp
@@ -141,7 +141,8 @@ ModResult ModuleDelayMsg::HandleMessage(User* user, const MessageTarget& target,
 	{
 		if (channel->GetPrefixValue(user) < VOICE_VALUE)
 		{
-			user->WriteNumeric(ERR_CANNOTSENDTOCHAN, channel->name, InspIRCd::Format("You must wait %d seconds after joining to send to the channel (+d is set)", len));
+			const std::string message = InspIRCd::Format("You cannot send messages to this channel until you have been a member for %d seconds.", len);
+			user->WriteNumeric(Numerics::CannotSendTo(channel, message));
 			return MOD_RES_DENY;
 		}
 	}
diff --git a/src/modules/m_disable.cpp b/src/modules/m_disable.cpp
index 50345323a..36c4783bf 100644
--- a/src/modules/m_disable.cpp
+++ b/src/modules/m_disable.cpp
@@ -163,8 +163,9 @@ class ModuleDisable : public Module
 
 		// The user has tried to change a disabled mode!
 		const char* what = mh->GetModeType() == MODETYPE_CHANNEL ? "channel" : "user";
-		WriteLog("%s was blocked from executing the disabled %s mode %c (%s)",
-			user->GetFullRealHost().c_str(), what, mh->GetModeChar(), mh->name.c_str());
+		WriteLog("%s was blocked from %ssetting the disabled %s mode %c (%s)",
+			user->GetFullRealHost().c_str(), adding ? "" : "un",
+			what, mh->GetModeChar(), mh->name.c_str());
 
 		if (fakenonexistent)
 		{
diff --git a/src/modules/m_dnsbl.cpp b/src/modules/m_dnsbl.cpp
index a16384560..e48009395 100644
--- a/src/modules/m_dnsbl.cpp
+++ b/src/modules/m_dnsbl.cpp
@@ -158,7 +158,7 @@ class DNSBLResolver : public DNS::Request
 							"*", them->GetIPString());
 					if (ServerInstance->XLines->AddLine(kl,NULL))
 					{
-						ServerInstance->SNO.WriteGlobalSno('x', "K-line added due to DNSBL match on *@%s to expire in %s (on %s): %s",
+						ServerInstance->SNO.WriteToSnoMask('x', "K-line added due to DNSBL match on *@%s to expire in %s (on %s): %s",
 							them->GetIPString().c_str(), InspIRCd::DurationString(kl->duration).c_str(),
 							InspIRCd::TimeString(kl->expiry).c_str(), reason.c_str());
 						ServerInstance->XLines->ApplyLines();
@@ -176,7 +176,7 @@ class DNSBLResolver : public DNS::Request
 							"*", them->GetIPString());
 					if (ServerInstance->XLines->AddLine(gl,NULL))
 					{
-						ServerInstance->SNO.WriteGlobalSno('x', "G-line added due to DNSBL match on *@%s to expire in %s (on %s): %s",
+						ServerInstance->SNO.WriteToSnoMask('x', "G-line added due to DNSBL match on *@%s to expire in %s (on %s): %s",
 							them->GetIPString().c_str(), InspIRCd::DurationString(gl->duration).c_str(),
 							InspIRCd::TimeString(gl->expiry).c_str(), reason.c_str());
 						ServerInstance->XLines->ApplyLines();
@@ -194,7 +194,7 @@ class DNSBLResolver : public DNS::Request
 							them->GetIPString());
 					if (ServerInstance->XLines->AddLine(zl,NULL))
 					{
-						ServerInstance->SNO.WriteGlobalSno('x', "Z-line added due to DNSBL match on %s to expire in %s (on %s): %s",
+						ServerInstance->SNO.WriteToSnoMask('x', "Z-line added due to DNSBL match on %s to expire in %s (on %s): %s",
 							them->GetIPString().c_str(), InspIRCd::DurationString(zl->duration).c_str(),
 							InspIRCd::TimeString(zl->expiry).c_str(), reason.c_str());
 						ServerInstance->XLines->ApplyLines();
diff --git a/src/modules/m_filter.cpp b/src/modules/m_filter.cpp
index d377d7295..f57cb83ff 100644
--- a/src/modules/m_filter.cpp
+++ b/src/modules/m_filter.cpp
@@ -405,7 +405,7 @@ ModResult ModuleFilter::OnUserPreMessage(User* user, const MessageTarget& msgtar
 				break;
 			}
 			case MessageTarget::TYPE_SERVER:
-				break;
+				return MOD_RES_PASSTHRU;
 		}
 
 		if (is_selfmsg && warnonselfmsg)
@@ -427,9 +427,9 @@ ModResult ModuleFilter::OnUserPreMessage(User* user, const MessageTarget& msgtar
 			if (notifyuser)
 			{
 				if (msgtarget.type == MessageTarget::TYPE_CHANNEL)
-					user->WriteNumeric(ERR_CANNOTSENDTOCHAN, msgtarget.GetName(), InspIRCd::Format("Message to channel blocked and opers notified (%s)", f->reason.c_str()));
+					user->WriteNumeric(Numerics::CannotSendTo(msgtarget.Get<Channel>(), InspIRCd::Format("Your message to this channel was blocked: %s.", f->reason.c_str())));
 				else
-					user->WriteNotice("Your message to "+msgtarget.GetName()+" was blocked and opers notified: "+f->reason);
+					user->WriteNumeric(Numerics::CannotSendTo(msgtarget.Get<User>(), InspIRCd::Format("Your message to this user was blocked: %s.", f->reason.c_str())));
 			}
 			else
 				details.echo_original = true;
@@ -439,9 +439,9 @@ ModResult ModuleFilter::OnUserPreMessage(User* user, const MessageTarget& msgtar
 			if (notifyuser)
 			{
 				if (msgtarget.type == MessageTarget::TYPE_CHANNEL)
-					user->WriteNumeric(ERR_CANNOTSENDTOCHAN, msgtarget.GetName(), InspIRCd::Format("Message to channel blocked (%s)", f->reason.c_str()));
+					user->WriteNumeric(Numerics::CannotSendTo(msgtarget.Get<Channel>(), InspIRCd::Format("Your message to this channel was blocked: %s.", f->reason.c_str())));
 				else
-					user->WriteNotice("Your message to "+msgtarget.GetName()+" was blocked: "+f->reason);
+					user->WriteNumeric(Numerics::CannotSendTo(msgtarget.Get<User>(), InspIRCd::Format("Your message to this user was blocked: %s.", f->reason.c_str())));
 			}
 			else
 				details.echo_original = true;
diff --git a/src/modules/m_geoban.cpp b/src/modules/m_geoban.cpp
index 139a3e3dd..8fc6d41ab 100644
--- a/src/modules/m_geoban.cpp
+++ b/src/modules/m_geoban.cpp
@@ -70,6 +70,9 @@ class ModuleGeoBan
 
 	void OnWhois(Whois::Context& whois) override
 	{
+		if (whois.GetTarget()->server->IsULine())
+			return;
+
 		Geolocation::Location* location = geoapi ? geoapi->GetLocation(whois.GetTarget()) : NULL;
 		if (location)
 			whois.SendLine(RPL_WHOISCOUNTRY, location->GetCode(), "is connecting from " + location->GetName());
diff --git a/src/modules/m_hostchange.cpp b/src/modules/m_hostchange.cpp
index afc580065..1f7d59b20 100644
--- a/src/modules/m_hostchange.cpp
+++ b/src/modules/m_hostchange.cpp
@@ -176,7 +176,9 @@ private:
 			}
 		}
 
-		const std::string hmap = ServerInstance->Config->ConfValue("hostname")->getString("charmap", "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz.-_/0123456789");
+		ConfigTag* tag = ServerInstance->Config->ConfValue("hostname");
+		const std::string hmap = tag->getString("charmap", "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz.-_/0123456789", 1);
+
 		hostmap.reset();
 		for (std::string::const_iterator iter = hmap.begin(); iter != hmap.end(); ++iter)
 			hostmap.set(static_cast<unsigned char>(*iter));
diff --git a/src/modules/m_httpd.cpp b/src/modules/m_httpd.cpp
index 06bdb1ae7..9c3e13a2c 100644
--- a/src/modules/m_httpd.cpp
+++ b/src/modules/m_httpd.cpp
@@ -81,6 +81,7 @@ class HttpServerSocket : public BufferedSocket, public Timer, public insp::intru
 	{
 		if (!messagecomplete)
 		{
+			ServerInstance->Logs.Log(MODNAME, LOG_DEBUG, "HTTP socket %d timed out", GetFd());
 			Close();
 			return false;
 		}
@@ -212,6 +213,8 @@ class HttpServerSocket : public BufferedSocket, public Timer, public insp::intru
 			// IOHook may have errored
 			if (!getError().empty())
 			{
+				ServerInstance->Logs.Log(MODNAME, LOG_DEBUG, "HTTP socket %d encountered a hook error: %s",
+					GetFd(), getError().c_str());
 				Close();
 				return;
 			}
@@ -237,8 +240,10 @@ class HttpServerSocket : public BufferedSocket, public Timer, public insp::intru
 		ServerInstance->GlobalCulls.AddItem(this);
 	}
 
-	void OnError(BufferedSocketError) override
+	void OnError(BufferedSocketError err) override
 	{
+		ServerInstance->Logs.Log(MODNAME, LOG_DEBUG, "HTTP socket %d encountered an error: %d - %s",
+			GetFd(), err, getError().c_str());
 		Close();
 	}
 
diff --git a/src/modules/m_ident.cpp b/src/modules/m_ident.cpp
index 3a48ac97a..234d5652a 100644
--- a/src/modules/m_ident.cpp
+++ b/src/modules/m_ident.cpp
@@ -284,7 +284,7 @@ class ModuleIdent : public Module
 		// Check that they haven't been prefixed already.
 		if (user->ident[0] == '~')
 			return;
-		
+
 		// All invalid usernames are prefixed with a tilde.
 		std::string newident(user->ident);
 		newident.insert(newident.begin(), '~');
diff --git a/src/modules/m_ircv3_ctctags.cpp b/src/modules/m_ircv3_ctctags.cpp
index 0babae709..e288d5210 100644
--- a/src/modules/m_ircv3_ctctags.cpp
+++ b/src/modules/m_ircv3_ctctags.cpp
@@ -89,7 +89,7 @@ class CommandTagMsg : public Command
 		{
 			LocalUser* luser = IS_LOCAL(iter->first);
 
-			// Don't send to remote users or the user who is the source. 
+			// Don't send to remote users or the user who is the source.
 			if (!luser || luser == source)
 				continue;
 
@@ -336,7 +336,7 @@ class ModuleIRCv3CTCTags
 			if (chan->IsModeSet(noextmsgmode) && !chan->HasUser(user))
 			{
 				// The noextmsg mode is set and the user is not in the channel.
-				user->WriteNumeric(ERR_CANNOTSENDTOCHAN, chan->name, "Cannot send to channel (no external messages)");
+				user->WriteNumeric(Numerics::CannotSendTo(chan, "external messages", *noextmsgmode));
 				return MOD_RES_DENY;
 			}
 
@@ -344,7 +344,7 @@ class ModuleIRCv3CTCTags
 			if (no_chan_priv && chan->IsModeSet(moderatedmode))
 			{
 				// The moderated mode is set and the user has no status rank.
-				user->WriteNumeric(ERR_CANNOTSENDTOCHAN, chan->name, "Cannot send to channel (+m is set)");
+				user->WriteNumeric(Numerics::CannotSendTo(chan, "messages", *noextmsgmode));
 				return MOD_RES_DENY;
 			}
 
@@ -352,7 +352,7 @@ class ModuleIRCv3CTCTags
 			{
 				// The user is banned in the channel and restrictbannedusers is enabled.
 				if (ServerInstance->Config->RestrictBannedUsers == ServerConfig::BUT_RESTRICT_NOTIFY)
-					user->WriteNumeric(ERR_CANNOTSENDTOCHAN, chan->name, "Cannot send to channel (you're banned)");
+					user->WriteNumeric(Numerics::CannotSendTo(chan, "You cannot send messages to this channel whilst banned."));
 				return MOD_RES_DENY;
 			}
 		}
diff --git a/src/modules/m_muteban.cpp b/src/modules/m_muteban.cpp
index 5b26626ee..6fd0c7c10 100644
--- a/src/modules/m_muteban.cpp
+++ b/src/modules/m_muteban.cpp
@@ -67,7 +67,7 @@ class ModuleQuietBan
 				return MOD_RES_DENY;
 			}
 
-			user->WriteNumeric(ERR_CANNOTSENDTOCHAN, chan->name, "Cannot send to channel (you're muted)");
+			user->WriteNumeric(Numerics::CannotSendTo(chan, "messages", 'm', "mute"));
 			return MOD_RES_DENY;
 		}
 
diff --git a/src/modules/m_nationalchars.cpp b/src/modules/m_nationalchars.cpp
index 5742a52e1..145c7c3b2 100644
--- a/src/modules/m_nationalchars.cpp
+++ b/src/modules/m_nationalchars.cpp
@@ -274,7 +274,7 @@ class ModuleNationalChars : public Module
 	{
 		ConfigTag* tag = ServerInstance->Config->ConfValue("nationalchars");
 		charset = tag->getString("file");
-		std::string casemapping = tag->getString("casemapping", FileSystem::GetFileName(charset));
+		std::string casemapping = tag->getString("casemapping", FileSystem::GetFileName(charset), 1);
 		if (casemapping.find(' ') != std::string::npos)
 			throw ModuleException("<nationalchars:casemapping> must not contain any spaces!");
 		ServerInstance->Config->CaseMapping = casemapping;
diff --git a/src/modules/m_noctcp.cpp b/src/modules/m_noctcp.cpp
index e3c7aa0b6..0d8ecf8a1 100644
--- a/src/modules/m_noctcp.cpp
+++ b/src/modules/m_noctcp.cpp
@@ -82,11 +82,15 @@ class ModuleNoCTCP
 				if (res == MOD_RES_ALLOW)
 					return MOD_RES_PASSTHRU;
 
-				bool modeset = c->IsModeSet(nc);
-				if (!c->GetExtBanStatus(user, 'C').check(!modeset))
+				if (c->IsModeSet(nc))
 				{
-					user->WriteNumeric(ERR_CANNOTSENDTOCHAN, c->name, InspIRCd::Format("Can't send CTCP to channel (%s)",
-						modeset ? "+C is set" : "you're extbanned"));
+					user->WriteNumeric(Numerics::CannotSendTo(c, "CTCPs", &nc));
+					return MOD_RES_DENY;
+				}
+
+				if (c->GetExtBanStatus(user, 'C') == MOD_RES_DENY)
+				{
+					user->WriteNumeric(Numerics::CannotSendTo(c, "CTCPs", 'C', "noctcp"));
 					return MOD_RES_DENY;
 				}
 				break;
@@ -99,7 +103,7 @@ class ModuleNoCTCP
 				User* u = target.Get<User>();
 				if (u->IsModeSet(ncu))
 				{
-					user->WriteNumeric(ERR_CANTSENDTOUSER, u->nick, "Can't send CTCP to user (+T is set)");
+					user->WriteNumeric(Numerics::CannotSendTo(u, "CTCPs", &ncu));
 					return MOD_RES_DENY;
 				}
 				break;
diff --git a/src/modules/m_nonotice.cpp b/src/modules/m_nonotice.cpp
index 18b27ae7f..f9210006d 100644
--- a/src/modules/m_nonotice.cpp
+++ b/src/modules/m_nonotice.cpp
@@ -60,11 +60,15 @@ class ModuleNoNotice
 			if (res == MOD_RES_ALLOW)
 				return MOD_RES_PASSTHRU;
 
-			bool modeset = c->IsModeSet(nt);
-			if (!c->GetExtBanStatus(user, 'T').check(!modeset))
+			if (c->IsModeSet(nt))
 			{
-				user->WriteNumeric(ERR_CANNOTSENDTOCHAN, c->name, InspIRCd::Format("Can't send NOTICE to channel (%s)",
-					modeset ? "+T is set" : "you're extbanned"));
+				user->WriteNumeric(Numerics::CannotSendTo(c, "notices", &nt));
+				return MOD_RES_DENY;
+			}
+
+			if (c->GetExtBanStatus(user, 'T') == MOD_RES_DENY)
+			{
+				user->WriteNumeric(Numerics::CannotSendTo(c, "notices", 'T', "nonotice"));
 				return MOD_RES_DENY;
 			}
 		}
diff --git a/src/modules/m_opermotd.cpp b/src/modules/m_opermotd.cpp
index 3f4c99b09..781d4aa94 100644
--- a/src/modules/m_opermotd.cpp
+++ b/src/modules/m_opermotd.cpp
@@ -114,7 +114,7 @@ class ModuleOpermotd : public Module
 
 		try
 		{
-			FileReader reader(conf->getString("file", "opermotd"));
+			FileReader reader(conf->getString("file", "opermotd", 1));
 			cmd.opermotd = reader.GetVector();
 			InspIRCd::ProcessColors(cmd.opermotd);
 		}
diff --git a/src/modules/m_passforward.cpp b/src/modules/m_passforward.cpp
index 1e0d0b4ff..35b10ba5a 100644
--- a/src/modules/m_passforward.cpp
+++ b/src/modules/m_passforward.cpp
@@ -41,7 +41,7 @@ class ModulePassForward : public Module
 		ConfigTag* tag = ServerInstance->Config->ConfValue("passforward");
 		nickrequired = tag->getString("nick", "NickServ");
 		forwardmsg = tag->getString("forwardmsg", "NOTICE $nick :*** Forwarding PASS to $nickrequired");
-		forwardcmd = tag->getString("cmd", "SQUERY $nickrequired :IDENTIFY $pass");
+		forwardcmd = tag->getString("cmd", "SQUERY $nickrequired :IDENTIFY $pass", 1);
 	}
 
 	void FormatStr(std::string& result, const std::string& format, const LocalUser* user)
@@ -105,11 +105,14 @@ class ModulePassForward : public Module
 		}
 
 		std::string tmp;
-		FormatStr(tmp, forwardmsg, user);
-		ServerInstance->Parser.ProcessBuffer(user, tmp);
+		if (!forwardmsg.empty())
+		{
+			FormatStr(tmp, forwardmsg, user);
+			ServerInstance->Parser.ProcessBuffer(user, tmp);
+			tmp.clear();
+		}
 
-		tmp.clear();
-		FormatStr(tmp,forwardcmd, user);
+		FormatStr(tmp, forwardcmd, user);
 		ServerInstance->Parser.ProcessBuffer(user, tmp);
 	}
 };
diff --git a/src/modules/m_randquote.cpp b/src/modules/m_randquote.cpp
index b8f261aca..2badebfcb 100644
--- a/src/modules/m_randquote.cpp
+++ b/src/modules/m_randquote.cpp
@@ -37,7 +37,7 @@ class ModuleRandQuote : public Module
 		ConfigTag* conf = ServerInstance->Config->ConfValue("randquote");
 		prefix = conf->getString("prefix");
 		suffix = conf->getString("suffix");
-		FileReader reader(conf->getString("file", "quotes"));
+		FileReader reader(conf->getString("file", "quotes", 1));
 		quotes = reader.GetVector();
 	}
 
diff --git a/src/modules/m_regex_stdlib.cpp b/src/modules/m_regex_stdlib.cpp
index 4e6f5beaf..0e048d6f4 100644
--- a/src/modules/m_regex_stdlib.cpp
+++ b/src/modules/m_regex_stdlib.cpp
@@ -73,8 +73,8 @@ public:
 	void ReadConfig(ConfigStatus& status) override
 	{
 		ConfigTag* Conf = ServerInstance->Config->ConfValue("stdregex");
-		std::string regextype = Conf->getString("type", "ecmascript");
 
+		const std::string regextype = Conf->getString("type", "ecmascript", 1);
 		if (stdalgo::string::equalsci(regextype, "bre"))
 			ref.regextype = std::regex::basic;
 		else if (stdalgo::string::equalsci(regextype, "ere"))
diff --git a/src/modules/m_restrictchans.cpp b/src/modules/m_restrictchans.cpp
index ba88afa68..e00a9e84e 100644
--- a/src/modules/m_restrictchans.cpp
+++ b/src/modules/m_restrictchans.cpp
@@ -75,7 +75,10 @@ class ModuleRestrictChans : public Module
 	{
 		// channel does not yet exist (record is null, about to be created IF we were to allow it)
 		if (!chan && !CanCreateChannel(user, cname))
+		{
+			user->WriteNumeric(ERR_BANNEDFROMCHAN, cname, "You are not allowed to create new channels.");
 			return MOD_RES_DENY;
+		}
 
 		return MOD_RES_PASSTHRU;
 	}
diff --git a/src/modules/m_restrictmsg.cpp b/src/modules/m_restrictmsg.cpp
index 0ba62c40c..13117e713 100644
--- a/src/modules/m_restrictmsg.cpp
+++ b/src/modules/m_restrictmsg.cpp
@@ -43,10 +43,9 @@ class ModuleRestrictMsg
 			// (3) the recipient is on a ulined server
 			// anything else, blocked.
 			if (u->IsOper() || user->IsOper() || u->server->IsULine())
-			{
 				return MOD_RES_PASSTHRU;
-			}
-			user->WriteNumeric(ERR_CANTSENDTOUSER, u->nick, "You are not permitted to send private messages to this user");
+
+			user->WriteNumeric(Numerics::CannotSendTo(u, "You cannot send messages to this user."));
 			return MOD_RES_DENY;
 		}
 
diff --git a/src/modules/m_sethost.cpp b/src/modules/m_sethost.cpp
index 0ab6c3444..a96c3b9fe 100644
--- a/src/modules/m_sethost.cpp
+++ b/src/modules/m_sethost.cpp
@@ -80,10 +80,11 @@ class ModuleSetHost : public Module
 
 	void ReadConfig(ConfigStatus& status) override
 	{
-		std::string hmap = ServerInstance->Config->ConfValue("hostname")->getString("charmap", "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz.-_/0123456789");
+		ConfigTag* tag = ServerInstance->Config->ConfValue("hostname");
+		const std::string hmap = tag->getString("charmap", "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz.-_/0123456789", 1);
 
 		cmd.hostmap.reset();
-		for (std::string::iterator n = hmap.begin(); n != hmap.end(); n++)
+		for (std::string::const_iterator n = hmap.begin(); n != hmap.end(); n++)
 			cmd.hostmap.set(static_cast<unsigned char>(*n));
 	}
 
diff --git a/src/modules/m_shun.cpp b/src/modules/m_shun.cpp
index 068c51cdc..3176b915f 100644
--- a/src/modules/m_shun.cpp
+++ b/src/modules/m_shun.cpp
@@ -156,7 +156,6 @@ class ModuleShun : public Module, public Stats::EventListener
 	ShunFactory f;
 	insp::flat_set<std::string> ShunEnabledCommands;
 	bool NotifyOfShun;
-	bool affectopers;
 
  public:
 	ModuleShun()
@@ -194,24 +193,16 @@ class ModuleShun : public Module, public Stats::EventListener
 	void ReadConfig(ConfigStatus& status) override
 	{
 		ConfigTag* tag = ServerInstance->Config->ConfValue("shun");
-		std::string cmds = tag->getString("enabledcommands");
-		std::transform(cmds.begin(), cmds.end(), cmds.begin(), ::toupper);
-
-		if (cmds.empty())
-			cmds = "PING PONG QUIT";
 
 		ShunEnabledCommands.clear();
-
-		irc::spacesepstream dcmds(cmds);
-		std::string thiscmd;
-
-		while (dcmds.GetToken(thiscmd))
+		irc::spacesepstream enabledcmds(tag->getString("enabledcommands", "ADMIN OPER PING PONG QUIT", 1));
+		for (std::string enabledcmd; enabledcmds.GetToken(enabledcmd); )
 		{
-			ShunEnabledCommands.insert(thiscmd);
+			std::transform(enabledcmd.begin(), enabledcmd.end(), enabledcmd.begin(), ::toupper);
+			ShunEnabledCommands.insert(enabledcmd);
 		}
 
 		NotifyOfShun = tag->getBool("notifyuser", true);
-		affectopers = tag->getBool("affectopers", false);
 	}
 
 	ModResult OnPreCommand(std::string& command, CommandBase::Params& parameters, LocalUser* user, bool validated) override
@@ -219,19 +210,11 @@ class ModuleShun : public Module, public Stats::EventListener
 		if (validated)
 			return MOD_RES_PASSTHRU;
 
-		if (!ServerInstance->XLines->MatchesLine("SHUN", user))
-		{
-			/* Not shunned, don't touch. */
+		// Exempt the user from shuns if they have the servers/ignore-shun privilege.
+		if (user->HasPrivPermission("servers/ignore-shun"))
 			return MOD_RES_PASSTHRU;
-		}
-
-		if (!affectopers && user->IsOper())
-		{
-			/* Don't do anything if the user is an operator and affectopers isn't set */
-			return MOD_RES_PASSTHRU;
-		}
 
-		if (!ShunEnabledCommands.count(command))
+		if (ServerInstance->XLines->MatchesLine("SHUN", user) && !ShunEnabledCommands.count(command))
 		{
 			if (NotifyOfShun)
 				user->WriteNotice("*** Command " + command + " not processed, as you have been blocked from issuing commands (SHUN)");
diff --git a/src/modules/m_spanningtree/main.cpp b/src/modules/m_spanningtree/main.cpp
index 472f78c37..10c380c54 100644
--- a/src/modules/m_spanningtree/main.cpp
+++ b/src/modules/m_spanningtree/main.cpp
@@ -213,7 +213,7 @@ void ModuleSpanningTree::ConnectServer(Link* x, Autoconnect* y)
 		// If this fails then the IP sa will be AF_UNSPEC.
 		irc::sockets::aptosa(x->IPAddr, x->Port, sa);
 	}
-	
+
 	/* Do we already have an IP? If so, no need to resolve it. */
 	if (sa.family() != AF_UNSPEC)
 	{
@@ -418,7 +418,7 @@ void ModuleSpanningTree::OnUserPostMessage(User* user, const MessageTarget& targ
 			const std::string* serverglob = target.Get<std::string>();
 			CmdBuilder par(user, message_type);
 			par.push_tags(details.tags_out);
-			par.push(*serverglob);
+			par.push(std::string("$") + *serverglob);
 			par.push_last(details.text);
 			par.Broadcast();
 			break;
@@ -455,7 +455,7 @@ void ModuleSpanningTree::OnUserPostTagMessage(User* user, const MessageTarget& t
 			const std::string* serverglob = target.Get<std::string>();
 			CmdBuilder par(user, "TAGMSG");
 			par.push_tags(details.tags_out);
-			par.push(*serverglob);
+			par.push(std::string("$") + *serverglob);
 			par.Broadcast();
 			break;
 		}
diff --git a/src/modules/m_spanningtree/treesocket2.cpp b/src/modules/m_spanningtree/treesocket2.cpp
index 5dd7f8dd4..1afc7f1ab 100644
--- a/src/modules/m_spanningtree/treesocket2.cpp
+++ b/src/modules/m_spanningtree/treesocket2.cpp
@@ -407,7 +407,7 @@ void TreeSocket::OnTimeout()
 
 void TreeSocket::Close()
 {
-	if (fd < 0)
+	if (!HasFd())
 		return;
 
 	ServerInstance->GlobalCulls.AddItem(this);
diff --git a/src/modules/m_sqloper.cpp b/src/modules/m_sqloper.cpp
index ff01af6ad..71264f26f 100644
--- a/src/modules/m_sqloper.cpp
+++ b/src/modules/m_sqloper.cpp
@@ -189,7 +189,7 @@ public:
 		else
 			SQL.SetProvider("SQL/" + dbid);
 
-		query = tag->getString("query", "SELECT * FROM ircd_opers WHERE active=1;");
+		query = tag->getString("query", "SELECT * FROM ircd_opers WHERE active=1;", 1);
 		// Update sqloper list from the database.
 		GetOperBlocks();
 	}
diff --git a/src/modules/m_sslinfo.cpp b/src/modules/m_sslinfo.cpp
index 3b6ed3e5c..853871aae 100644
--- a/src/modules/m_sslinfo.cpp
+++ b/src/modules/m_sslinfo.cpp
@@ -257,6 +257,7 @@ class ModuleSSLInfo
 				{
 					user->WriteNumeric(ERR_NOOPERHOST, "This oper login requires an SSL connection.");
 					user->CommandFloodPenalty += 10000;
+					ServerInstance->SNO.WriteGlobalSno('o', "WARNING! Failed oper attempt by %s using login '%s': secure connection required.", user->GetFullRealHost().c_str(), parameters[0].c_str());
 					return MOD_RES_DENY;
 				}
 
@@ -265,6 +266,7 @@ class ModuleSSLInfo
 				{
 					user->WriteNumeric(ERR_NOOPERHOST, "This oper login requires a matching SSL certificate fingerprint.");
 					user->CommandFloodPenalty += 10000;
+					ServerInstance->SNO.WriteGlobalSno('o', "WARNING! Failed oper attempt by %s using login '%s': client certificate fingerprint does not match.", user->GetFullRealHost().c_str(), parameters[0].c_str());
 					return MOD_RES_DENY;
 				}
 			}
diff --git a/src/modules/m_sslmodes.cpp b/src/modules/m_sslmodes.cpp
index 616822cb0..e9d34600f 100644
--- a/src/modules/m_sslmodes.cpp
+++ b/src/modules/m_sslmodes.cpp
@@ -199,7 +199,7 @@ class ModuleSSLModes
 			if (!api || !api->GetCertificate(user))
 			{
 				/* The sending user is not on an SSL connection */
-				user->WriteNumeric(ERR_CANTSENDTOUSER, target->nick, "You are not permitted to send private messages to this user (+z is set)");
+				user->WriteNumeric(Numerics::CannotSendTo(target, "messages", &sslquery));
 				return MOD_RES_DENY;
 			}
 		}
@@ -208,7 +208,7 @@ class ModuleSSLModes
 		{
 			if (!api || !api->GetCertificate(target))
 			{
-				user->WriteNumeric(ERR_CANTSENDTOUSER, target->nick, "You must remove user mode 'z' before you are able to send private messages to a non-SSL user.");
+				user->WriteNumeric(Numerics::CannotSendTo(target, "messages", &sslquery, true));
 				return MOD_RES_DENY;
 			}
 		}
diff --git a/src/modules/m_uninvite.cpp b/src/modules/m_uninvite.cpp
index 0ab1be44d..cb42f003a 100644
--- a/src/modules/m_uninvite.cpp
+++ b/src/modules/m_uninvite.cpp
@@ -30,6 +30,8 @@
 enum
 {
 	// InspIRCd-specific.
+	ERR_INVITEREMOVED = 494,
+	ERR_NOTINVITED = 505,
 	RPL_UNINVITED = 653
 };
 
@@ -91,14 +93,14 @@ class CommandUninvite : public Command
 			// so they don't see where the target user is connected to
 			if (!invapi->Remove(lu, c))
 			{
-				Numeric::Numeric n(505);
+				Numeric::Numeric n(ERR_NOTINVITED);
 				n.SetServer(user->server);
 				n.push(u->nick).push(c->name).push(InspIRCd::Format("Is not invited to channel %s", c->name.c_str()));
 				user->WriteRemoteNumeric(n);
 				return CMD_FAILURE;
 			}
 
-			Numeric::Numeric n(494);
+			Numeric::Numeric n(ERR_INVITEREMOVED);
 			n.SetServer(user->server);
 			n.push(c->name).push(u->nick).push("Uninvited");
 			user->WriteRemoteNumeric(n);
diff --git a/src/modules/m_xline_db.cpp b/src/modules/m_xline_db.cpp
index 70e782c10..efa35270a 100644
--- a/src/modules/m_xline_db.cpp
+++ b/src/modules/m_xline_db.cpp
@@ -53,7 +53,7 @@ class ModuleXLineDB
 		 * 		...and so is discarding all current in-memory XLines for the ones in the database.
 		 */
 		ConfigTag* Conf = ServerInstance->Config->ConfValue("xlinedb");
-		xlinedbpath = ServerInstance->Config->Paths.PrependData(Conf->getString("filename", "xline.db"));
+		xlinedbpath = ServerInstance->Config->Paths.PrependData(Conf->getString("filename", "xline.db", 1));
 		SetInterval(Conf->getDuration("saveperiod", 5));
 
 		// Read xlines before attaching to events
diff --git a/src/users.cpp b/src/users.cpp
index c024ef366..1c5400a98 100644
--- a/src/users.cpp
+++ b/src/users.cpp
@@ -90,7 +90,7 @@ User::User(const std::string& uid, Server* srv, UserType type)
 	ServerInstance->Logs.Log("USERS", LOG_DEBUG, "New UUID for user: %s", uuid.c_str());
 
 	if (srv->IsULine())
-		ServerInstance->Users.all_ulines.push_back(this);	
+		ServerInstance->Users.all_ulines.push_back(this);
 
 	// Do not insert FakeUsers into the uuidlist so FindUUID() won't return them which is the desired behavior
 	if (type != USERTYPE_SERVER)
@@ -497,7 +497,7 @@ void LocalUser::CheckClass(bool clone_count)
 	}
 	else if (a->type == CC_DENY)
 	{
-		ServerInstance->Users.QuitUser(this, a->config->getString("reason", "Unauthorised connection"));
+		ServerInstance->Users.QuitUser(this, a->config->getString("reason", "Unauthorised connection", 1));
 		return;
 	}
 	else if (clone_count)