Software /
code /
prosody-modules
File
mod_muc_auto_reserve_nicks/mod_muc_auto_reserve_nicks.lua @ 6193:e977174082ee
mod_invites_register_api: Use set_password() for password resets
Previously the code relied on the (weird) behaviour of create_user(), which
would update the password for a user account if it already existed. This has
several issues, and we plan to deprecate this behaviour of create_user().
The larger issue is that this route does not trigger the user-password-changed
event, which can be a security problem. For example, it did not disconnect
existing user sessions (this occurs in mod_c2s in response to the event).
Switching to set_password() is the right thing to do
author | Matthew Wild <mwild1@gmail.com> |
---|---|
date | Thu, 06 Feb 2025 10:24:30 +0000 |
parent | 4950:c83bc703825d |
line wrap: on
line source
local jid = require "util.jid"; local set = require "util.set"; local active_affiliations = set.new({ "member", "admin", "owner" }); module:hook("muc-occupant-joined", function (event) local room, occupant = event.room, event.occupant; local user_jid = occupant.bare_jid; local user_affiliation = room:get_affiliation(user_jid); if not active_affiliations:contains(user_affiliation) then return; end local aff_data = event.room:get_affiliation_data(user_jid); if not aff_data then local reserved_nick = jid.resource(occupant.nick); module:log("debug", "Automatically reserving nickname '%s' for <%s>", reserved_nick, user_jid); room:set_affiliation_data(user_jid, "reserved_nickname", reserved_nick); room._reserved_nicks = nil; -- force refresh of nickname map end end);