Mercurial > prosody-hg

annotate plugins/mod_vcard4.lua @ 14150:2a66728d9e29 13.0 13.0.5

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_proxy65: Consistently apply authorization checks The module checked for authorization when a client asked for the address:port of the proxy service. It did not check for authorization when processing a request to activate a bytestream. This meant that any unauthenticated party able to guess the IP/port and XMPP domain of a proxy65 service (generally low difficulty) would be able to use the proxy to relay traffic between two connections. This factors out the permission check, and applies it to every request type.
author Matthew Wild <mwild1@gmail.com>
date Wed, 29 Apr 2026 11:40:43 +0100
parents 74b9e05af71e
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
12977
74b9e05af71e plugins: Prefix module imports with prosody namespace
Kim Alvefur <zash@zash.se>
parents: 10707
diff changeset
1 local st = require "prosody.util.stanza"
74b9e05af71e plugins: Prefix module imports with prosody namespace
Kim Alvefur <zash@zash.se>
parents: 10707
diff changeset
2 local jid_split = require "prosody.util.jid".split;
9261
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
3
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
4 local mod_pep = module:depends("pep");
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
5
9283
e977b64ebd81 mod_vcard4: Advertise feature on account instead of host
Kim Alvefur <zash@zash.se>
parents: 9261
diff changeset
6 module:hook("account-disco-info", function (event)
e977b64ebd81 mod_vcard4: Advertise feature on account instead of host
Kim Alvefur <zash@zash.se>
parents: 9261
diff changeset
7 event.reply:tag("feature", { var = "urn:ietf:params:xml:ns:vcard-4.0" }):up();
e977b64ebd81 mod_vcard4: Advertise feature on account instead of host
Kim Alvefur <zash@zash.se>
parents: 9261
diff changeset
8 end);
9261
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
9
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
10 module:hook("iq-get/bare/urn:ietf:params:xml:ns:vcard-4.0:vcard", function (event)
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
11 local origin, stanza = event.origin, event.stanza;
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
12
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
13 local pep_service = mod_pep.get_pep_service(jid_split(stanza.attr.to) or origin.username);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
14 local ok, id, item = pep_service:get_last_item("urn:xmpp:vcard4", stanza.attr.from);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
15 if ok and item then
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
16 origin.send(st.reply(stanza):add_child(item.tags[1]));
10707
c4b49939b471 mod_vcard4: Report correct error condition (fixes #1521)
Kim Alvefur <zash@zash.se>
parents: 9283
diff changeset
17 elseif id == "item-not-found" or not id then
9261
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
18 origin.send(st.error_reply(stanza, "cancel", "item-not-found"));
10707
c4b49939b471 mod_vcard4: Report correct error condition (fixes #1521)
Kim Alvefur <zash@zash.se>
parents: 9283
diff changeset
19 elseif id == "forbidden" then
9261
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
20 origin.send(st.error_reply(stanza, "auth", "forbidden"));
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
21 else
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
22 origin.send(st.error_reply(stanza, "modify", "undefined-condition"));
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
23 end
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
24 return true;
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
25 end);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
26
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
27 module:hook("iq-set/self/urn:ietf:params:xml:ns:vcard-4.0:vcard", function (event)
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
28 local origin, stanza = event.origin, event.stanza;
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
29
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
30 local vcard4 = st.stanza("item", { xmlns = "http://jabber.org/protocol/pubsub", id = "current" })
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
31 :add_child(stanza.tags[1]);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
32
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
33 local pep_service = mod_pep.get_pep_service(origin.username);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
34
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
35 local ok, err = pep_service:publish("urn:xmpp:vcard4", origin.full_jid, "current", vcard4);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
36 if ok then
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
37 origin.send(st.reply(stanza));
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
38 elseif err == "forbidden" then
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
39 origin.send(st.error_reply(stanza, "auth", "forbidden"));
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
40 else
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
41 origin.send(st.error_reply(stanza, "modify", "undefined-condition", err));
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
42 end
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
43 return true;
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
44 end);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
45