Changeset

4653:2b6e8ce5fb30

mod_http_upload: Don’t send http: URIs to clients, this is forbidden by the XEP
author Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
date Wed, 25 Aug 2021 10:22:37 +0200
parents 4652:e524a97730eb
children 4654:ea17cfcbffab
files mod_http_upload/mod_http_upload.lua
diffstat 1 files changed, 5 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/mod_http_upload/mod_http_upload.lua	Mon Aug 23 14:28:40 2021 +0200
+++ b/mod_http_upload/mod_http_upload.lua	Wed Aug 25 10:22:37 2021 +0200
@@ -198,6 +198,11 @@
 		module:log("debug", "Upload of %dB by %s would exceed quota", filesize, user_bare);
 		return nil, st.error_reply(stanza, "wait", "resource-constraint", "Quota reached");
 	end
+	local base_url = module:http_url();
+	if base_url:match("^http://") then
+		module:log("error", "File upload MUST happen with TLS but it isn’t enabled, see https://prosody.im/doc/http for how to fix this issue");
+		return nil, st.error_reply(stanza, "wait", "internal-server-error", "HTTPS is not configured properly on the server");
+	end
 
 	local random_dir = uuid();
 	local created, err = lfs.mkdir(join_path(storage_path, random_dir));
@@ -225,7 +230,6 @@
 
 	origin.log("debug", "Given upload slot %q", slot);
 
-	local base_url = module:http_url();
 	local slot_url = url.parse(base_url);
 	slot_url.path = url.parse_path(slot_url.path or "/");
 	t_insert(slot_url.path, random_dir);