File

mod_http_oauth2: Reject URLs with 'userinfo' part (thanks mimi89999) The LuaSocket parser supports these but they're deprecated without replacement by RFC 3986 > Use of the format "user:password" in the userinfo field is deprecated Allowing it in OAuth2 URLs is probably bad from a security perspective.

module:hook("message/host", function (event)
	local stanza = event.stanza;
	if #stanza.tags == 1 and stanza.tags[1].attr.xmlns == "http://jabber.org/protocol/chatstates" then
		return true;
	end
end, -10);