File

mod_server_info/mod_server_info.lua @ 6191:94399ad6b5ab

mod_invites_register_api: Use set_password() for password resets Previously the code relied on the (weird) behaviour of create_user(), which would update the password for a user account if it already existed. This has several issues, and we plan to deprecate this behaviour of create_user(). The larger issue is that this route does not trigger the user-password-changed event, which can be a security problem. For example, it did not disconnect existing user sessions (this occurs in mod_c2s in response to the event). Switching to set_password() is the right thing to do.
author Matthew Wild <mwild1@gmail.com>
date Thu, 06 Feb 2025 10:13:39 +0000
parent 5950:f408b8e603af
line wrap: on
line source

-- mod_server_info imported from Prosody commit 1ce18cb3e6cc for the benefit
-- of 0.12 deployments. This community version of the module will not load in
-- newer Prosody versions, which include their own copy of the module.
--% conflicts: mod_server_info

local dataforms = require "util.dataforms";

local server_info_config = module:get_option("server_info", {});
local server_info_custom_fields = module:get_option_array("server_info_extensions");

-- Source: http://xmpp.org/registrar/formtypes.html#http:--jabber.org-network-serverinfo
local form_layout = dataforms.new({
	{ var = "FORM_TYPE"; type = "hidden"; value = "http://jabber.org/network/serverinfo" };
});

if server_info_custom_fields then
	for _, field in ipairs(server_info_custom_fields) do
		table.insert(form_layout, field);
	end
end

local generated_form;

function update_form()
	local new_form = form_layout:form(server_info_config, "result");
	if generated_form then
		module:remove_item("extension", generated_form);
	end
	generated_form = new_form;
	module:add_item("extension", generated_form);
end

function add_fields(event)
	local fields = event.item;
	for _, field in ipairs(fields) do
		table.insert(form_layout, field);
	end
	update_form();
end

function remove_fields(event)
	local removed_fields = event.item;
	for _, removed_field in ipairs(removed_fields) do
		local removed_var = removed_field.var or removed_field.name;
		for i, field in ipairs(form_layout) do
			local var = field.var or field.name
			if var == removed_var then
				table.remove(form_layout, i);
				break;
			end
		end
	end
	update_form();
end

module:handle_items("server-info-fields", add_fields, remove_fields);

function module.load()
	update_form();
end