Software /
code /
prosody-modules
File
mod_auto156/mod_auto156.lua @ 6193:e977174082ee
mod_invites_register_api: Use set_password() for password resets
Previously the code relied on the (weird) behaviour of create_user(), which
would update the password for a user account if it already existed. This has
several issues, and we plan to deprecate this behaviour of create_user().
The larger issue is that this route does not trigger the user-password-changed
event, which can be a security problem. For example, it did not disconnect
existing user sessions (this occurs in mod_c2s in response to the event).
Switching to set_password() is the right thing to do
author | Matthew Wild <mwild1@gmail.com> |
---|---|
date | Thu, 06 Feb 2025 10:24:30 +0000 |
parent | 4614:5d494dba9c02 |
line wrap: on
line source
-- Synthesize XEP-0156 JSON from DNS local array = require "util.array"; local encodings = require "util.encodings"; local json = require "util.json"; local promise = require "util.promise"; local dns = require"net.adns".resolver(); local function check_dns(domain) return dns:lookup_promise("_xmppconnect." .. domain, "TXT"); end local function check_domain(domain) return promise.resolve(domain):next(encodings.stringprep.nameprep):next(encodings.idna.to_ascii):next( function(domain_A) if not domain_A then return promise.reject(400); else return domain_A; end end):next(check_dns):next(function(txt) local uris = array(); for _, cm in ipairs(txt) do local kind, uri = tostring(cm.txt):match("^_xmpp%-client%-(%w+)=([hpstw]+s?://.*)"); if kind then uris:push({rel = "urn:xmpp:alt-connections:" .. kind, href = uri}); end end if #uris == 0 then return promise.reject(404); end return {links=uris}; end); end module:depends("http"); module:provides("http", { route = { ["GET /*"] = function(_, domain) return check_domain(domain):next(function(altmethods) return {headers = {content_type = "application/json"}, body = json.encode(altmethods)}; end); end, }, }); function module.command(args) local async = require "util.async"; for _, domain in ipairs(args) do print(assert(async.wait_for(check_domain(domain):next(json.encode)))); end end