File

util/session.lua @ 13843:87dd8639f08f 13.0

mod_invites_register: Stricter validation of registration events This fixes two problems: 1) Account invites that were created with a specific username were not in fact restricted to that username. 2) Password reset invites were not restricted to resetting passwords, but could be used to create an arbitrary new account if the client or registration frontend (e.g. mod_invites_register_web) doesn't handle/enforce the username. This new validation ensures that registrations and resets are always for the username specified in the invitation.
author Matthew Wild <mwild1@gmail.com>
date Thu, 10 Apr 2025 16:07:32 +0100
parent 13165:9c13c11b199d
line wrap: on
line source

local initialize_filters = require "prosody.util.filters".initialize;
local time = require "prosody.util.time";
local logger = require "prosody.util.logger";

local function new_session(typ)
	local session = {
		type = typ .. "_unauthed";
		base_type = typ;
		since = time.now();
	};
	return session;
end

local function set_id(session)
	local id = session.base_type .. tostring(session):match("%x+$"):lower();
	session.id = id;
	return session;
end

local function set_logger(session)
	local log = logger.init(session.id);
	session.log = log;
	return session;
end

local function set_conn(session, conn)
	session.conn = conn;
	session.ip = conn:ip();
	return session;
end

local function set_send(session)
	local conn = session.conn;
	if not conn then
		function session.send(data)
			session.log("debug", "Discarding data sent to unconnected session: %s", data);
			return false;
		end
		return session;
	end
	local filter = initialize_filters(session);
	local w = conn.write;
	session.send = function (t)
		if t.name then
			t = filter("stanzas/out", t);
		end
		if t then
			t = filter("bytes/out", tostring(t));
			if t then
				local ret, err = w(conn, t);
				if not ret then
					session.log("debug", "Error writing to connection: %s", err);
					return false, err;
				end
			end
		end
		return true;
	end
	return session;
end

local function set_role(session, role)
	session.role = role;
end

return {
	new = new_session;

	set_id = set_id;
	set_logger = set_logger;
	set_conn = set_conn;
	set_send = set_send;
	set_role = set_role;
}