Mercurial > prosody-modules
diff mod_muc_mav/mod_muc_mav.lua @ 6540:7cb25e7d945d
mod_muc_mav: Prevent JIDs leaking to occupants who are not allowed
The occupant-id is always there so the list is still useful to them.
| author | Stephen Paul Weber <singpolyma@singpolyma.net> |
|---|---|
| date | Mon, 18 May 2026 10:23:58 -0500 |
| parents | 4d7e2d0db2ab |
| children | 03c80b7308bf |
line wrap: on
line diff
--- a/mod_muc_mav/mod_muc_mav.lua Mon May 18 10:23:12 2026 -0500 +++ b/mod_muc_mav/mod_muc_mav.lua Mon May 18 10:23:58 2026 -0500 @@ -1,6 +1,7 @@ local st = require "util.stanza"; local hashes = require "util.hashes"; local base64 = require "util.encodings".base64; +local util_jid = require "util.jid"; local mod_muc = module:depends"muc"; @@ -11,14 +12,15 @@ local mav_versions = {} -local function get_affiliations(room) +local function get_affiliations(from, room) local jid_affiliations = {} local x = st.stanza("x", {xmlns = xmlns_muc_user;}); for jid, affiliation, affiliation_data in room:each_affiliation() do table.insert(jid_affiliations, jid.."\0"..affiliation); local occupant_id = room:get_occupant_id_from_jid(jid); local nick = affiliation_data and affiliation_data.reserved_nickname; - x:tag("item", {affiliation = affiliation or "none"; jid = jid; nick = nick;}) + local show_jid = not room:is_anonymous_for(from) or util_jid.bare(from) == jid and jid or nil + x:tag("item", {affiliation = affiliation or "none"; jid = show_jid; nick = nick;}) :tag("occupant-id", { xmlns = xmlns_occupant_id, id = occupant_id }):up():up(); end table.sort(jid_affiliations); @@ -37,7 +39,7 @@ if is_initial then muc_x:tag("mav", {xmlns = xmlns_mav; ["until"] = mav_current;}):up(); else - local mav_new = get_affiliations(room); + local mav_new = get_affiliations(stanza.attr.from, room); if mav_current ~= mav_new then module:log("info", "Update version of %s from %s to %s in affiliation update", stanza.attr.to, mav_current, mav_new); muc_x:tag("mav", {xmlns = xmlns_mav; ["since"] = mav_current; ["until"] = mav_new; }):up(); @@ -79,7 +81,7 @@ if not mav_child then return; end local mav_since = mav_child.attr["since"]; mav_versions[room.jid.."\0"..stanza.attr.from] = mav_since; - local mav_current, x = get_affiliations(room); + local mav_current, x = get_affiliations(stanza.attr.from, room); if mav_current ~= mav_since then -- TODO: Support for diffs -- Send full response