File

mod_muc_config_restrict/mod_muc_config_restrict.lua @ 3503:882180b459a0

mod_pubsub_post: Restructure authentication and authorization (BC) This deprecates the default "superuser" actor model and makes the default equivalent to the previous "request.id". A single actor and secret per node is supported because HTTP and WebHooks don't normally include any authorization identity. Allowing authentication bypass when no secret is given should be relatively safe when the actor is unprivileged, as will be unless explicitly configured otherwise.
author Kim Alvefur <zash@zash.se>
date Sat, 30 Mar 2019 21:16:13 +0100
parent 1014:ed7431fd3b47
line wrap: on
line source

local is_admin = require "core.usermanager".is_admin;
local t_remove = table.remove;

local restricted_options = module:get_option_set("muc_config_restricted", {})._items;

function handle_config_submit(event)
	local stanza = event.stanza;
	if is_admin(stanza.attr.from, module.host) then return; end -- Don't restrict admins
	local fields = event.fields;
	for option in restricted_options do
		fields[option] = nil; -- Like it was never there
	end
end

function handle_config_request(event)
	if is_admin(event.actor, module.host) then return; end -- Don't restrict admins
	local form = event.form;
	for i = #form, 1, -1 do
		if restricted_options[form[i].name] then
			t_remove(form, i);
		end
	end
end

module:hook("muc-config-submitted", handle_config_submit);
module:hook("muc-config-form", handle_config_request);