Software /
code /
prosody-modules
File
mod_server_info/mod_server_info.lua @ 6191:94399ad6b5ab
mod_invites_register_api: Use set_password() for password resets
Previously the code relied on the (weird) behaviour of create_user(), which
would update the password for a user account if it already existed. This has
several issues, and we plan to deprecate this behaviour of create_user().
The larger issue is that this route does not trigger the user-password-changed
event, which can be a security problem. For example, it did not disconnect
existing user sessions (this occurs in mod_c2s in response to the event).
Switching to set_password() is the right thing to do.
author | Matthew Wild <mwild1@gmail.com> |
---|---|
date | Thu, 06 Feb 2025 10:13:39 +0000 |
parent | 5950:f408b8e603af |
line wrap: on
line source
-- mod_server_info imported from Prosody commit 1ce18cb3e6cc for the benefit -- of 0.12 deployments. This community version of the module will not load in -- newer Prosody versions, which include their own copy of the module. --% conflicts: mod_server_info local dataforms = require "util.dataforms"; local server_info_config = module:get_option("server_info", {}); local server_info_custom_fields = module:get_option_array("server_info_extensions"); -- Source: http://xmpp.org/registrar/formtypes.html#http:--jabber.org-network-serverinfo local form_layout = dataforms.new({ { var = "FORM_TYPE"; type = "hidden"; value = "http://jabber.org/network/serverinfo" }; }); if server_info_custom_fields then for _, field in ipairs(server_info_custom_fields) do table.insert(form_layout, field); end end local generated_form; function update_form() local new_form = form_layout:form(server_info_config, "result"); if generated_form then module:remove_item("extension", generated_form); end generated_form = new_form; module:add_item("extension", generated_form); end function add_fields(event) local fields = event.item; for _, field in ipairs(fields) do table.insert(form_layout, field); end update_form(); end function remove_fields(event) local removed_fields = event.item; for _, removed_field in ipairs(removed_fields) do local removed_var = removed_field.var or removed_field.name; for i, field in ipairs(form_layout) do local var = field.var or field.name if var == removed_var then table.remove(form_layout, i); break; end end end update_form(); end module:handle_items("server-info-fields", add_fields, remove_fields); function module.load() update_form(); end