annotate mod_component_client/README.md @ 6165:e977174082ee
mod_invites_register_api: Use set_password() for password resets
Previously the code relied on the (weird) behaviour of create_user(), which
would update the password for a user account if it already existed. This has
several issues, and we plan to deprecate this behaviour of create_user().
The larger issue is that this route does not trigger the user-password-changed
event, which can be a security problem. For example, it did not disconnect
existing user sessions (this occurs in mod_c2s in response to the event).
Switching to set_password() is the right thing to do
| author |
Matthew Wild <mwild1@gmail.com> |
| date |
Thu, 06 Feb 2025 10:24:30 +0000 |
| parents |
fe081789f7b5 |
| children |
|
| rev |
line source |
|
2323
|
1 Introduction
|
|
|
2 ============
|
|
|
3
|
|
|
4 This module turns Prosody hosts into components of other XMPP servers.
|
|
|
5
|
|
|
6 Configuration
|
|
|
7 =============
|
|
|
8
|
|
|
9 Example configuration:
|
|
|
10
|
|
|
11 ``` {.lua}
|
|
|
12 VirtualHost "component.example.com"
|
|
|
13 modules_enabled = { "component_client" }
|
|
|
14 component_client = {
|
|
|
15 host = "localhost";
|
|
|
16 port = 5347;
|
|
|
17 secret = "hunter2";
|
|
|
18 }
|
|
|
19 ```
|
