Mercurial > prosody-modules
view mod_register_dnsbl_warn/mod_register_dnsbl_warn.lua @ 6165:e977174082ee
mod_invites_register_api: Use set_password() for password resets
Previously the code relied on the (weird) behaviour of create_user(), which
would update the password for a user account if it already existed. This has
several issues, and we plan to deprecate this behaviour of create_user().
The larger issue is that this route does not trigger the user-password-changed
event, which can be a security problem. For example, it did not disconnect
existing user sessions (this occurs in mod_c2s in response to the event).
Switching to set_password() is the right thing to do
| author | Matthew Wild <mwild1@gmail.com> |
|---|---|
| date | Thu, 06 Feb 2025 10:24:30 +0000 |
| parents | 76036fa34055 |
| children |
line wrap: on
line source
local adns = require "net.adns"; local rbl = module:get_option_string("registration_rbl"); local function reverse(ip, suffix) if ip:sub(1,7):lower() == "::ffff:" then ip = ip:sub(8); end local a,b,c,d = ip:match("^(%d+).(%d+).(%d+).(%d+)$"); if not a then return end return ("%d.%d.%d.%d.%s"):format(d,c,b,a, suffix); end -- TODO async -- module:hook("user-registering", function (event) end); module:hook("user-registered", function (event) local session = event.session; local ip = session and session.ip; local rbl_ip = ip and reverse(ip, rbl); if rbl_ip then local log = session.log; adns.lookup(function (reply) if reply and reply[1] then log("warn", "Account %s@%s registered from IP %s found in RBL (%s)", event.username, event.host or module.host, ip, reply[1].a); end end, rbl_ip); end end);
