File

mod_jid_prep/mod_jid_prep.lua @ 6193:e977174082ee

mod_invites_register_api: Use set_password() for password resets Previously the code relied on the (weird) behaviour of create_user(), which would update the password for a user account if it already existed. This has several issues, and we plan to deprecate this behaviour of create_user(). The larger issue is that this route does not trigger the user-password-changed event, which can be a security problem. For example, it did not disconnect existing user sessions (this occurs in mod_c2s in response to the event). Switching to set_password() is the right thing to do
author Matthew Wild <mwild1@gmail.com>
date Thu, 06 Feb 2025 10:24:30 +0000
parent 1404:99cb06b31ae8
line wrap: on
line source

-- Run JIDs through stringprep processing on behalf of clients
-- http://xmpp.org/extensions/inbox/jidprep.html

local jid_prep = require "util.jid".prep;
local st = require "util.stanza";

local xmlns_prep = "urn:xmpp:jidprep:0";

module:add_feature(xmlns_prep);

function prep_jid(event)
	local stanza = event.stanza;
	local jid = jid_prep(stanza:get_child_text("jid", xmlns_prep));
	if not jid then
		return event.origin.send(st.error_reply(stanza, "modify", "jid-malformed"));
	end
	return event.origin.send(st.reply(stanza):tag("jid", { xmlns = xmlns_prep }):text(jid));
end


module:hook("iq/host/"..xmlns_prep..":jid", prep_jid);

module:depends("http");
module:provides("http", {
	route = {
		["GET /*"] = function (event, jid)
			return jid_prep(jid) or 400;
		end;
	}
});