prosody
53e0ae770917
plugins/mod_welcome.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

plugins/mod_welcome.lua @ 12180:53e0ae770917

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
author Jonas Schäfer <jonas@wielicki.name>
date Mon, 10 Jan 2022 18:23:54 +0100
parent 8161:31938a0c398f
child 12977:74b9e05af71e
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1523
841d61be198f Remove version number from copyright headers
Matthew Wild <mwild1@gmail.com>
parents: 1252
diff changeset
1 -- Prosody IM
2923
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 2056
diff changeset
2 -- Copyright (C) 2008-2010 Matthew Wild
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 2056
diff changeset
3 -- Copyright (C) 2008-2010 Waqas Hussain
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 5014
diff changeset
4 --
1185
c68ccb7faeaf mod_welcome: New plugin to welcome users who register on the server
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
5 -- This project is MIT/X11 licensed. Please see the
c68ccb7faeaf mod_welcome: New plugin to welcome users who register on the server
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
6 -- COPYING file in the source package for more information.
c68ccb7faeaf mod_welcome: New plugin to welcome users who register on the server
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
7 --
c68ccb7faeaf mod_welcome: New plugin to welcome users who register on the server
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
8
c68ccb7faeaf mod_welcome: New plugin to welcome users who register on the server
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
9 local host = module:get_host();
7227
c6f9d694d778 mod_welcome: Pass default text to config API as default value
Kim Alvefur <zash@zash.se>
parents: 7226
diff changeset
10 local welcome_text = module:get_option_string("welcome_message", "Hello $username, welcome to the $host IM server!");
1185
c68ccb7faeaf mod_welcome: New plugin to welcome users who register on the server
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
11
c68ccb7faeaf mod_welcome: New plugin to welcome users who register on the server
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
12 local st = require "util.stanza";
c68ccb7faeaf mod_welcome: New plugin to welcome users who register on the server
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
13
3540
bc139431830b Monster whitespace commit (beware the whitespace monster).
Waqas Hussain <waqas20@gmail.com>
parents: 2923
diff changeset
14 module:hook("user-registered",
1185
c68ccb7faeaf mod_welcome: New plugin to welcome users who register on the server
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
15 function (user)
3540
bc139431830b Monster whitespace commit (beware the whitespace monster).
Waqas Hussain <waqas20@gmail.com>
parents: 2923
diff changeset
16 local welcome_stanza =
8160
5566f82ffea4 mod_welcome: Return the pointer to the root of the stanza, fixes a bug similar to #922.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 5014
diff changeset
17 st.message({ to = user.username.."@"..user.host, from = host },
5566f82ffea4 mod_welcome: Return the pointer to the root of the stanza, fixes a bug similar to #922.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 5014
diff changeset
18 welcome_text:gsub("$(%w+)", user));
5014
b2006c1cfa85 mod_announce, mod_motd, mod_pubsub, mod_register, mod_watchregistrations, mod_welcome: Use module:send() instead of core_*_stanza()
Kim Alvefur <zash@zash.se>
parents: 3540
diff changeset
19 module:send(welcome_stanza);
1185
c68ccb7faeaf mod_welcome: New plugin to welcome users who register on the server
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
20 module:log("debug", "Welcomed user %s@%s", user.username, user.host);
c68ccb7faeaf mod_welcome: New plugin to welcome users who register on the server
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
21 end);