Software / code / prosody
File
plugins/mod_vcard4.lua @ 12474:8fac32810144 0.12
mod_s2s: Improve robustness of outgoing s2s certificate verification
This change ensures we have positively verified the certificates of the server
we are connecting to before marking the session as authenticated. It protects
against situations where the verify-or-close stage of the connection was
interrupted (e.g. due to an uncaught error).
Thanks to Zash for discovery and testing.
| author | Matthew Wild <mwild1@gmail.com> |
|---|---|
| date | Mon, 25 Apr 2022 15:07:49 +0100 |
| parent | 10707:c4b49939b471 |
| child | 12977:74b9e05af71e |
line wrap: on
line source
local st = require "util.stanza" local jid_split = require "util.jid".split; local mod_pep = module:depends("pep"); module:hook("account-disco-info", function (event) event.reply:tag("feature", { var = "urn:ietf:params:xml:ns:vcard-4.0" }):up(); end); module:hook("iq-get/bare/urn:ietf:params:xml:ns:vcard-4.0:vcard", function (event) local origin, stanza = event.origin, event.stanza; local pep_service = mod_pep.get_pep_service(jid_split(stanza.attr.to) or origin.username); local ok, id, item = pep_service:get_last_item("urn:xmpp:vcard4", stanza.attr.from); if ok and item then origin.send(st.reply(stanza):add_child(item.tags[1])); elseif id == "item-not-found" or not id then origin.send(st.error_reply(stanza, "cancel", "item-not-found")); elseif id == "forbidden" then origin.send(st.error_reply(stanza, "auth", "forbidden")); else origin.send(st.error_reply(stanza, "modify", "undefined-condition")); end return true; end); module:hook("iq-set/self/urn:ietf:params:xml:ns:vcard-4.0:vcard", function (event) local origin, stanza = event.origin, event.stanza; local vcard4 = st.stanza("item", { xmlns = "http://jabber.org/protocol/pubsub", id = "current" }) :add_child(stanza.tags[1]); local pep_service = mod_pep.get_pep_service(origin.username); local ok, err = pep_service:publish("urn:xmpp:vcard4", origin.full_jid, "current", vcard4); if ok then origin.send(st.reply(stanza)); elseif err == "forbidden" then origin.send(st.error_reply(stanza, "auth", "forbidden")); else origin.send(st.error_reply(stanza, "modify", "undefined-condition", err)); end return true; end);