Mercurial > prosody-modules
view mod_admin_notify/mod_admin_notify.lua @ 6165:e977174082ee
mod_invites_register_api: Use set_password() for password resets
Previously the code relied on the (weird) behaviour of create_user(), which
would update the password for a user account if it already existed. This has
several issues, and we plan to deprecate this behaviour of create_user().
The larger issue is that this route does not trigger the user-password-changed
event, which can be a security problem. For example, it did not disconnect
existing user sessions (this occurs in mod_c2s in response to the event).
Switching to set_password() is the right thing to do
| author | Matthew Wild <mwild1@gmail.com> |
|---|---|
| date | Thu, 06 Feb 2025 10:24:30 +0000 |
| parents | 44e18454e1e0 |
| children |
line wrap: on
line source
local it = require "util.iterators"; local jid = require "util.jid"; local set = require "util.set"; local st = require "util.stanza"; local roles_store = module:open_store("roles", "map"); local config_admins = module:get_option_inherited_set("admins", {}) / jid.prep; local function append_host(username) return username.."@"..module.host; end local function get_admins() local role_admins = roles_store:get_all("prosody:admin") or {}; local admins = config_admins + (set.new(it.to_array(it.keys(role_admins))) / append_host); return admins; end function notify(text) --luacheck: ignore 131/notify local base_msg = st.message({ from = module.host }) :text_tag("body", text); for admin_jid in get_admins() do local msg = st.clone(base_msg); msg.attr.to = admin_jid; module:send(msg); end end
