mod_http_file_share: Switch to the new authz API (BC) Behavior change: It becomes up to the authorization module whether to allow requests. The default, mod_authz_internal, will allow users on the *parent* host only, breaking use by some components. Remaining question is whether to deprecate the `http_file_share_access` setting or leave as a way to complement/bypass access control?

author: Kim Alvefur <zash@zash.se>
date: Sat, 16 Sep 2023 14:23:08 +0200
parent: 13230:26c30844cac6
child: 13266:9c62ffbdf2ae
--- a/plugins/mod_http_file_share.lua	Mon Sep 04 00:38:45 2023 +0200
+++ b/plugins/mod_http_file_share.lua	Sat Sep 16 14:23:08 2023 +0200
@@ -47,6 +47,8 @@
 
 local access = module:get_option_set(module.name .. "_access", {});
 
+module:default_permission("prosody:registered", ":upload");
+
 if not external_base_url then
 	module:depends("http");
 end
@@ -136,7 +138,7 @@
 
 function may_upload(uploader, filename, filesize, filetype) -- > boolean, error
 	local uploader_host = jid.host(uploader);
-	if not ((access:empty() and prosody.hosts[uploader_host]) or access:contains(uploader) or access:contains(uploader_host)) then
+	if not (module:may(":upload", uploader) or access:contains(uploader) or access:contains(uploader_host)) then
 		return false, upload_errors.new("access");
 	end