Changeset

628:c72be31941fa

mod_compat_muc_admin: we shall make sure that only owners can destroy rooms and not everyone, isn't it?
author Marco Cirillo <maranda@lightwitch.org>
date Tue, 27 Mar 2012 16:07:52 +0000
parents 627:a8ff69c9b498
children 629:7d4cde86b12e
files mod_compat_muc_admin/mod_compat_muc_admin.lua
diffstat 1 files changed, 12 insertions(+), 10 deletions(-) [+]
line wrap: on
line diff
--- a/mod_compat_muc_admin/mod_compat_muc_admin.lua	Tue Mar 27 15:49:31 2012 +0000
+++ b/mod_compat_muc_admin/mod_compat_muc_admin.lua	Tue Mar 27 16:07:52 2012 +0000
@@ -117,17 +117,19 @@
 			elseif xmlns == xmlns_mo and stanza.tags[1].tags[1] then
 				local child = stanza.tags[1].tags[1];
 				if child.name == "destroy" then
-					local newjid = child.attr.jid;
-					local reason, password;
-					for _,tag in ipairs(child.tags) do
-						if tag.name == "reason" then
-							reason = #tag.tags == 0 and tag[1];
-						elseif tag.name == "password" then
-							password = #tag.tags == 0 and tag[1];
+					if self:get_affiliation(stanza.attr.from) == "owner" then
+						local newjid = child.attr.jid;
+						local reason, password;
+						for _,tag in ipairs(child.tags) do
+							if tag.name == "reason" then
+								reason = #tag.tags == 0 and tag[1];
+							elseif tag.name == "password" then
+								password = #tag.tags == 0 and tag[1];
+							end
 						end
-					end
-					self:destroy(newjid, reason, password);
-					origin.send(st.reply(stanza));
+						self:destroy(newjid, reason, password);
+						origin.send(st.reply(stanza));
+					else origin.send(st.error_reply(stanza, "auth", "forbidden", "Only owners can destroy rooms")); end
 				else
 					self:compat_iq(origin, stanza, xmlns);
 				end