Software /
code /
prosody-modules
File
mod_lib_ldap/dev/t/TestConnection.pm @ 6191:94399ad6b5ab
mod_invites_register_api: Use set_password() for password resets
Previously the code relied on the (weird) behaviour of create_user(), which
would update the password for a user account if it already existed. This has
several issues, and we plan to deprecate this behaviour of create_user().
The larger issue is that this route does not trigger the user-password-changed
event, which can be a security problem. For example, it did not disconnect
existing user sessions (this occurs in mod_c2s in response to the event).
Switching to set_password() is the right thing to do.
author | Matthew Wild <mwild1@gmail.com> |
---|---|
date | Thu, 06 Feb 2025 10:13:39 +0000 |
parent | 1465:07582b8aaf84 |
line wrap: on
line source
package TestConnection; use strict; use warnings; use parent 'AnyEvent::XMPP::IM::Connection'; use 5.010; our $HOST = 'localhost'; our $TIMEOUT = 5; our %PASSWORD_FOR = ( one => '12345', two => '23451', three => '34512', four => '45123', five => '51234', six => '123456', seven => '1234567', ); sub new { my ( $class, $username, %options ) = @_; my $cond = AnyEvent->condvar; my $timer = AnyEvent->timer( after => $TIMEOUT, cb => sub { $cond->send('timeout'); }, ); my $self = $class->SUPER::new( username => $username, domain => $HOST, password => $options{'password'} // $PASSWORD_FOR{$username}, resource => 'test bot', ); $self->reg_cb(error => sub { my ( undef, $error ) = @_; $cond->send($error->string); }); bless $self, $class; $self->{'condvar'} = $cond; $self->{'timeout_timer'} = $timer; $self->connect; return $self; } sub cond { my ( $self ) = @_; return $self->{'condvar'}; } 1;