Software / code / prosody
Diff
plugins/muc/muc.lib.lua @ 11806:6f7d6712e250
MUC: Reject full JID in affiliation queries
XEP-0045 states:
> Affiliations are granted, revoked, and maintained based on the user's
> bare JID, not the nick as with roles.
Therefore inclusion of a full JID in affiliation queries is invalid.
Thanks to Ge0rG and Poezio for discovering this issue.
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Fri, 17 Sep 2021 16:28:07 +0200 |
| parent | 11713:7623767df468 |
| child | 11907:0dc2c3530d64 |
line wrap: on
line diff
--- a/plugins/muc/muc.lib.lua Fri Sep 17 12:42:04 2021 +0200 +++ b/plugins/muc/muc.lib.lua Fri Sep 17 16:28:07 2021 +0200 @@ -1050,6 +1050,9 @@ if not item.attr.jid then origin.send(st.error_reply(stanza, "modify", "jid-malformed")); return true; + elseif jid_resource(item.attr.jid) then + origin.send(st.error_reply(stanza, "modify", "jid-malformed", "Bare JID expected, got full JID")); + return true; end end if item.attr.nick then -- Validate provided nick
