prosody
5408d5100bd0
plugins/mod_legacyauth.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Comparison

plugins/mod_legacyauth.lua @ 1833:5408d5100bd0

mod_legacyauth: Don't allow server-generated resource identifiers, as these are not support by legacy auth.
author Waqas Hussain <waqas20@gmail.com>
date Sun, 27 Sep 2009 15:50:41 +0500
parent 1832:a805e4fe104a
child 1836:f4c88dd32724
comparison
equal deleted inserted replaced
1832:a805e4fe104a 1833:5408d5100bd0
50 username, password, resource = t_concat(username), t_concat(password), t_concat(resource); 50 username, password, resource = t_concat(username), t_concat(password), t_concat(resource);
51 username = nodeprep(username); 51 username = nodeprep(username);
52 resource = resourceprep(resource) 52 resource = resourceprep(resource)
53 local reply = st.reply(stanza); 53 local reply = st.reply(stanza);
54 require "core.usermanager" 54 require "core.usermanager"
55 if username and usermanager.validate_credentials(session.host, username, password) then 55 if username and resource and usermanager.validate_credentials(session.host, username, password) then
56 -- Authentication successful! 56 -- Authentication successful!
57 local success, err = sessionmanager.make_authenticated(session, username); 57 local success, err = sessionmanager.make_authenticated(session, username);
58 if success then 58 if success then
59 local err_type, err_msg; 59 local err_type, err_msg;
60 success, err_type, err, err_msg = sessionmanager.bind_resource(session, resource); 60 success, err_type, err, err_msg = sessionmanager.bind_resource(session, resource);
61 if not success then 61 if not success then
62 session.send(st.error_reply(stanza, err_type, err, err_msg)); 62 session.send(st.error_reply(stanza, err_type, err, err_msg));
63 session.username, session.type = nil, "c2s_unauthed"; -- FIXME should this be placed in sessionmanager? 63 session.username, session.type = nil, "c2s_unauthed"; -- FIXME should this be placed in sessionmanager?
64 return true;
65 elseif resource ~= session.resource then -- server changed resource, not supported by legacy auth
66 session.send(st.error_reply(stanza, "cancel", "conflict", "The requested resource could not be assigned to this session."));
67 session:close(); -- FIXME undo resource bind and auth instead of closing the session?
64 return true; 68 return true;
65 end 69 end
66 end 70 end
67 session.send(st.reply(stanza)); 71 session.send(st.reply(stanza));
68 return true; 72 return true;