Mercurial > prosody-hg

annotate plugins/mod_vcard4.lua @ 13843:87dd8639f08f 13.0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_invites_register: Stricter validation of registration events This fixes two problems: 1) Account invites that were created with a specific username were not in fact restricted to that username. 2) Password reset invites were not restricted to resetting passwords, but could be used to create an arbitrary new account if the client or registration frontend (e.g. mod_invites_register_web) doesn't handle/enforce the username. This new validation ensures that registrations and resets are always for the username specified in the invitation.
author Matthew Wild <mwild1@gmail.com>
date Thu, 10 Apr 2025 16:07:32 +0100
parents 74b9e05af71e
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
12977
74b9e05af71e plugins: Prefix module imports with prosody namespace
Kim Alvefur <zash@zash.se>
parents: 10707
diff changeset
1 local st = require "prosody.util.stanza"
74b9e05af71e plugins: Prefix module imports with prosody namespace
Kim Alvefur <zash@zash.se>
parents: 10707
diff changeset
2 local jid_split = require "prosody.util.jid".split;
9261
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
3
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
4 local mod_pep = module:depends("pep");
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
5
9283
e977b64ebd81 mod_vcard4: Advertise feature on account instead of host
Kim Alvefur <zash@zash.se>
parents: 9261
diff changeset
6 module:hook("account-disco-info", function (event)
e977b64ebd81 mod_vcard4: Advertise feature on account instead of host
Kim Alvefur <zash@zash.se>
parents: 9261
diff changeset
7 event.reply:tag("feature", { var = "urn:ietf:params:xml:ns:vcard-4.0" }):up();
e977b64ebd81 mod_vcard4: Advertise feature on account instead of host
Kim Alvefur <zash@zash.se>
parents: 9261
diff changeset
8 end);
9261
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
9
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
10 module:hook("iq-get/bare/urn:ietf:params:xml:ns:vcard-4.0:vcard", function (event)
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
11 local origin, stanza = event.origin, event.stanza;
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
12
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
13 local pep_service = mod_pep.get_pep_service(jid_split(stanza.attr.to) or origin.username);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
14 local ok, id, item = pep_service:get_last_item("urn:xmpp:vcard4", stanza.attr.from);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
15 if ok and item then
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
16 origin.send(st.reply(stanza):add_child(item.tags[1]));
10707
c4b49939b471 mod_vcard4: Report correct error condition (fixes #1521)
Kim Alvefur <zash@zash.se>
parents: 9283
diff changeset
17 elseif id == "item-not-found" or not id then
9261
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
18 origin.send(st.error_reply(stanza, "cancel", "item-not-found"));
10707
c4b49939b471 mod_vcard4: Report correct error condition (fixes #1521)
Kim Alvefur <zash@zash.se>
parents: 9283
diff changeset
19 elseif id == "forbidden" then
9261
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
20 origin.send(st.error_reply(stanza, "auth", "forbidden"));
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
21 else
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
22 origin.send(st.error_reply(stanza, "modify", "undefined-condition"));
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
23 end
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
24 return true;
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
25 end);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
26
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
27 module:hook("iq-set/self/urn:ietf:params:xml:ns:vcard-4.0:vcard", function (event)
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
28 local origin, stanza = event.origin, event.stanza;
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
29
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
30 local vcard4 = st.stanza("item", { xmlns = "http://jabber.org/protocol/pubsub", id = "current" })
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
31 :add_child(stanza.tags[1]);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
32
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
33 local pep_service = mod_pep.get_pep_service(origin.username);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
34
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
35 local ok, err = pep_service:publish("urn:xmpp:vcard4", origin.full_jid, "current", vcard4);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
36 if ok then
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
37 origin.send(st.reply(stanza));
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
38 elseif err == "forbidden" then
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
39 origin.send(st.error_reply(stanza, "auth", "forbidden"));
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
40 else
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
41 origin.send(st.error_reply(stanza, "modify", "undefined-condition", err));
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
42 end
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
43 return true;
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
44 end);
9db9e37610b7 mod_vcard4: Allow access to the vcard4 PEP node via iq syntax
Kim Alvefur <zash@zash.se>
parents:
diff changeset
45