Mercurial > prosody-hg
view plugins/mod_flags.lua @ 13843:87dd8639f08f 13.0
mod_invites_register: Stricter validation of registration events
This fixes two problems:
1) Account invites that were created with a specific username were not
in fact restricted to that username.
2) Password reset invites were not restricted to resetting passwords,
but could be used to create an arbitrary new account if the client
or registration frontend (e.g. mod_invites_register_web) doesn't
handle/enforce the username.
This new validation ensures that registrations and resets are always for the
username specified in the invitation.
| author | Matthew Wild <mwild1@gmail.com> |
|---|---|
| date | Thu, 10 Apr 2025 16:07:32 +0100 |
| parents | e77ef9a4604f |
| children |
line wrap: on
line source
local jid_node = require "prosody.util.jid".node; local flags = module:open_store("account_flags", "keyval+"); -- API function add_flag(username, flag, comment) local flag_data = { when = os.time(); comment = comment; }; local ok, err = flags:set_key(username, flag, flag_data); if not ok then return nil, err; end module:fire_event("user-flag-added/"..flag, { user = username; flag = flag; data = flag_data; }); return true; end function remove_flag(username, flag) local ok, err = flags:set_key(username, flag, nil); if not ok then return nil, err; end module:fire_event("user-flag-removed/"..flag, { user = username; flag = flag; }); return true; end function has_flag(username, flag) -- luacheck: ignore 131/has_flag local ok, err = flags:get_key(username, flag); if not ok and err then error("Failed to check flags for user: "..err); end return not not ok; end function get_flag_info(username, flag) -- luacheck: ignore 131/get_flag_info return flags:get_key(username, flag); end -- Shell commands local function get_username(jid) return (assert(jid_node(jid), "please supply a valid user JID")); end module:add_item("shell-command", { section = "flags"; section_desc = "View and manage flags on user accounts"; name = "list"; desc = "List flags for the given user account"; args = { { name = "jid", type = "string" }; }; host_selector = "jid"; handler = function(self, jid) --luacheck: ignore 212/self local c = 0; local user_flags, err = flags:get(get_username(jid)); if not user_flags and err then return false, "Unable to list flags: "..err; end if user_flags then local print = self.session.print; for flag_name, flag_data in pairs(user_flags) do print(flag_name, os.date("%Y-%m-%d %R", flag_data.when), flag_data.comment); c = c + 1; end end return true, ("%d flags listed"):format(c); end; }); module:add_item("shell-command", { section = "flags"; section_desc = "View and manage flags on user accounts"; name = "add"; desc = "Add a flag to the given user account, with optional comment"; args = { { name = "jid", type = "string" }; { name = "flag", type = "string" }; { name = "comment", type = "string" }; }; host_selector = "jid"; handler = function(self, jid, flag, comment) --luacheck: ignore 212/self local username = get_username(jid); local ok, err = add_flag(username, flag, comment); if not ok then return false, "Failed to add flag: "..err; end return true, "Flag added"; end; }); module:add_item("shell-command", { section = "flags"; section_desc = "View and manage flags on user accounts"; name = "remove"; desc = "Remove a flag from the given user account"; args = { { name = "jid", type = "string" }; { name = "flag", type = "string" }; }; host_selector = "jid"; handler = function(self, jid, flag) --luacheck: ignore 212/self local username = get_username(jid); local ok, err = remove_flag(username, flag); if not ok then return false, "Failed to remove flag: "..err; end return true, "Flag removed"; end; }); module:add_item("shell-command", { section = "flags"; section_desc = "View and manage flags on user accounts"; name = "find"; desc = "Find all user accounts with a given flag on the specified host"; args = { { name = "host", type = "string" }; { name = "flag", type = "string" }; }; host_selector = "host"; handler = function(self, host, flag) --luacheck: ignore 212/self 212/host local users_with_flag = flags:get_key_from_all(flag); local print = self.session.print; local c = 0; for user, flag_data in pairs(users_with_flag) do print(user, os.date("%Y-%m-%d %R", flag_data.when), flag_data.comment); c = c + 1; end return true, ("%d accounts listed"):format(c); end; });
