File

mod_motd_sequential/mod_motd_sequential.lua @ 5705:527c747711f3

mod_http_oauth2: Limit revocation to clients own tokens in strict mode RFC 7009 section 2.1 states: > The authorization server first validates the client credentials (in > case of a confidential client) and then verifies whether the token was > issued to the client making the revocation request. If this > validation fails, the request is refused and the client is informed of > the error by the authorization server as described below. The first part was already covered (in strict mode). This adds the later part using the hash of client_id recorded in 0860497152af It still seems weird to me that revoking a leaked token should not be allowed whoever might have discovered it, as that seems the responsible thing to do.
author Kim Alvefur <zash@zash.se>
date Sun, 29 Oct 2023 11:30:49 +0100
parent 3401:8412592f3011
line wrap: on
line source

-- Prosody IM
-- Copyright (C) 2008-2010 Matthew Wild
-- Copyright (C) 2008-2010 Waqas Hussain
-- Copyright (C) 2010 Jeff Mitchell
--
-- This project is MIT/X11 licensed. Please see the
-- COPYING file in the source package for more information.
--

local core_route_stanza = prosody.core_route_stanza;
local host = module:get_host();
local motd_jid = module:get_option("motd_jid") or host;
local datamanager = require "util.datamanager";
local ipairs = ipairs;
local motd_sequential_messages = module:get_option("motd_sequential_messages") or {};
local motd_messagesets = {};
local max = 1;
for i, message in ipairs(motd_sequential_messages) do
    motd_messagesets[i] = message;
    max = i;
end

local st = require "util.stanza";

module:hook("resource-bind",
    function (event)
            local session = event.session;
    local alreadyseen_list = datamanager.load(session.username, session.host, "motd_sequential_seen") or { max = 0 };
    local alreadyseen = alreadyseen_list["max"] + 1;
    local motd_stanza;
    for i = alreadyseen, max do
            motd_stanza =
                    st.message({ to = session.username..'@'..session.host, from = motd_jid },
                            motd_messagesets[i]);
            core_route_stanza(hosts[host], motd_stanza);
            module:log("debug", "MOTD send to user %s@%s", session.username, session.host);
    end
    alreadyseen_list["max"] = max;
    datamanager.store(session.username, session.host, "motd_sequential_seen", alreadyseen_list);
end);