Mercurial > prosody-hg

diff plugins/muc/muc.lib.lua @ 12433:3dfcdcab5446 0.12

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
MUC: Allow kicking users with the same affiliation as the kicker (fixes #1724) This is allowed by XEP-0045, which states: "A moderator SHOULD NOT be allowed to revoke moderation privileges from someone with a higher affiliation than themselves (i.e., an unaffiliated moderator SHOULD NOT be allowed to revoke moderation privileges from an admin or an owner, and an admin SHOULD NOT be allowed to revoke moderation privileges from an owner)."
author Matthew Wild <mwild1@gmail.com>
date Wed, 23 Mar 2022 13:38:55 +0000
parents 83bec90a352c
children 74b9e05af71e eedae7d47784
line wrap: on
line diff
--- a/plugins/muc/muc.lib.lua	Wed Mar 23 15:29:01 2022 +0100
+++ b/plugins/muc/muc.lib.lua	Wed Mar 23 13:38:55 2022 +0000
@@ -1583,15 +1583,16 @@
 		return event.allowed, event.error, event.condition;
 	end
 
-	-- Can't do anything to other owners or admins
-	local occupant_affiliation = self:get_affiliation(occupant.bare_jid);
-	if occupant_affiliation == "owner" or occupant_affiliation == "admin" then
+	local actor_affiliation = self:get_affiliation(actor) or "none";
+	local occupant_affiliation = self:get_affiliation(occupant.bare_jid) or "none";
+
+	-- Can't do anything to someone with higher affiliation
+	if valid_affiliations[actor_affiliation] < valid_affiliations[occupant_affiliation] then
 		return nil, "cancel", "not-allowed";
 	end
 
 	-- If you are trying to give or take moderator role you need to be an owner or admin
 	if occupant.role == "moderator" or role == "moderator" then
-		local actor_affiliation = self:get_affiliation(actor);
 		if actor_affiliation ~= "owner" and actor_affiliation ~= "admin" then
 			return nil, "cancel", "not-allowed";
 		end