fix #1240

irc/handlers.go

 	fakeSource := msg.Params[1]
 	message := msg.Params[2:]
 
-	_, err := CasefoldName(fakeSource)
-	if err != nil {
-		client.Send(nil, client.server.name, ERR_CANNOTSENDRP, target, client.t("Fake source must be a valid nickname"))
-		return false
-	}
-
-	sourceString := fmt.Sprintf(npcNickMask, fakeSource, client.nick)
-
-	sendRoleplayMessage(server, client, sourceString, target, false, message, rb)
+	sendRoleplayMessage(server, client, fakeSource, target, false, false, message, rb)
 
 	return false
 }
 	target := msg.Params[0]
 	fakeSource := msg.Params[1]
 	message := msg.Params[2:]
-	sourceString := fmt.Sprintf(npcNickMask, fakeSource, client.nick)
-
-	_, err := CasefoldName(fakeSource)
-	if err != nil {
-		client.Send(nil, client.server.name, ERR_CANNOTSENDRP, target, client.t("Fake source must be a valid nickname"))
-		return false
-	}
 
-	sendRoleplayMessage(server, client, sourceString, target, true, message, rb)
+	sendRoleplayMessage(server, client, fakeSource, target, false, true, message, rb)
 
 	return false
 }
 func sceneHandler(server *Server, client *Client, msg ircmsg.IrcMessage, rb *ResponseBuffer) bool {
 	target := msg.Params[0]
 	message := msg.Params[1:]
-	sourceString := fmt.Sprintf(sceneNickMask, client.nick)
 
-	sendRoleplayMessage(server, client, sourceString, target, false, message, rb)
+	sendRoleplayMessage(server, client, "", target, true, false, message, rb)
 
 	return false
 }

irc/roleplay.go

 package irc
 
 import (
-	"bytes"
+	"fmt"
+	"strings"
 
 	"github.com/oragono/oragono/irc/history"
 	"github.com/oragono/oragono/irc/modes"
 	sceneNickMask = "=Scene=!%s@npc.fakeuser.invalid"
 )
 
-func sendRoleplayMessage(server *Server, client *Client, source string, targetString string, isAction bool, messageParts []string, rb *ResponseBuffer) {
+func sendRoleplayMessage(server *Server, client *Client, source string, targetString string, isScene, isAction bool, messageParts []string, rb *ResponseBuffer) {
 	config := server.Config()
 	if !config.Roleplay.Enabled {
 		rb.Add(nil, client.server.name, ERR_CANNOTSENDRP, targetString, client.t("Roleplaying has been disabled by the server administrators"))
 		return
 	}
 
+	var sourceMask string
+	if isScene {
+		sourceMask = fmt.Sprintf(sceneNickMask, client.Nick())
+	} else {
+		cfSource, cfSourceErr := CasefoldName(source)
+		skelSource, skelErr := Skeleton(source)
+		if cfSourceErr != nil || skelErr != nil ||
+			restrictedCasefoldedNicks.Has(cfSource) || restrictedSkeletons.Has(skelSource) {
+			rb.Add(nil, client.server.name, ERR_CANNOTSENDRP, targetString, client.t("Invalid roleplay name"))
+			return
+		}
+		sourceMask = fmt.Sprintf(npcNickMask, source, client.Nick())
+	}
+
 	// block attempts to send CTCP messages to Tor clients
 	if len(messageParts) > 0 && len(messageParts[0]) > 0 && messageParts[0][0] == '\x01' {
 		return
 	}
 
-	var buf bytes.Buffer
+	var buf strings.Builder
 	if isAction {
 		buf.WriteString("\x01ACTION ")
 	}
 				// of roleplay commands, so send them a copy whether they have echo-message
 				// or not
 				if rb.session == session {
-					rb.AddSplitMessageFromClient(source, "", nil, "PRIVMSG", targetString, splitMessage)
+					rb.AddSplitMessageFromClient(sourceMask, "", nil, "PRIVMSG", targetString, splitMessage)
 				} else {
-					session.sendSplitMsgFromClientInternal(false, source, "*", nil, "PRIVMSG", targetString, splitMessage)
+					session.sendSplitMsgFromClientInternal(false, sourceMask, "*", nil, "PRIVMSG", targetString, splitMessage)
 				}
 			}
 		}
 		channel.AddHistoryItem(history.Item{
 			Type:    history.Privmsg,
 			Message: splitMessage,
-			Nick:    source,
+			Nick:    sourceMask,
 		}, client.Account())
 	} else {
 		target, err := CasefoldName(targetString)
 		cnick := client.Nick()
 		tnick := user.Nick()
 		for _, session := range user.Sessions() {
-			session.sendSplitMsgFromClientInternal(false, source, "*", nil, "PRIVMSG", tnick, splitMessage)
+			session.sendSplitMsgFromClientInternal(false, sourceMask, "*", nil, "PRIVMSG", tnick, splitMessage)
 		}
 		if away, awayMessage := user.Away(); away {
 			//TODO(dan): possibly implement cooldown of away notifications to users