Software /
code /
prosody
File
plugins/muc/hats.lib.lua @ 12994:5625da6ae6b6
moduleapi: may: Fail early if a local session has no role assigned
We expect every session to explicitly have a role assigned. Falling back to
any kind of "default" role (even the user's default role) in the absence of
an explicit role could open up the possibility of accidental privilege
escalation.
author | Matthew Wild <mwild1@gmail.com> |
---|---|
date | Sat, 25 Mar 2023 19:38:41 +0000 |
parent | 12977:74b9e05af71e |
child | 13468:98806cac64c3 |
line wrap: on
line source
local st = require "prosody.util.stanza"; local muc_util = module:require "muc/util"; local xmlns_hats = "xmpp:prosody.im/protocol/hats:1"; -- Strip any hats claimed by the client (to prevent spoofing) muc_util.add_filtered_namespace(xmlns_hats); module:hook("muc-build-occupant-presence", function (event) local bare_jid = event.occupant and event.occupant.bare_jid or event.bare_jid; local aff_data = event.room:get_affiliation_data(bare_jid); local hats = aff_data and aff_data.hats; if not hats then return; end local hats_el; for hat_id, hat_data in pairs(hats) do if hat_data.active then if not hats_el then hats_el = st.stanza("hats", { xmlns = xmlns_hats }); end hats_el:tag("hat", { uri = hat_id, title = hat_data.title }):up(); end end if not hats_el then return; end event.stanza:add_direct_child(hats_el); end);