Tightened up the restrictions on User.hostmasks, also required privacy for it.

src/User.py

@@ -293,15 +293,25 @@ class User(callbacks.Privmsg):
         Returns the hostmasks of the user specified by <name>; if <name> isn't
         specified, returns the hostmasks of the user calling the command.
         """
-        if not args:
+        if ircutils.isChannel(msg.args[0]):
-            name = msg.prefix
+            irc.error(msg, conf.replyRequiresPrivacy)
+            return
+        name = privmsgs.getArgs(args, required=0, optional=1)
+        try:
+            user = ircdb.users.getUser(msg.prefix)
+            if name:
+                if name != user.name and not user.checkCapability('owner'):
+                    irc.error(msg, 'You may only retrieve your own hostmasks.')
                 else:
-            name = privmsgs.getArgs(args)
                     try:
                         user = ircdb.users.getUser(name)
                         irc.reply(msg, repr(user.hostmasks))
                     except KeyError:
                         irc.error(msg, conf.replyNoUser)
+            else:
+                irc.reply(msg, repr(user.hostmasks))
+        except KeyError:
+            irc.error(msg, conf.replyNotRegistered)
 
     def capabilities(self, irc, msg, args):
         """[<name>]