Software /
code /
prosody
File
util/session.lua @ 12659:c0eea4f6c739
usermanager: Add back temporary is_admin to warn about deprecated API usage
Goal: Introduce role-auth with minimal disruption
is_admin() is unsafe in a system with per-session permissions, so it has been
deprecated.
Roll-out approach:
1) First, log a warning when is_admin() is used. It should continue to
function normally, backed by the new role API. Nothing is really using
per-session authz yet, so there is minimal security concern.
The 'strict_deprecate_is_admin' global setting can be set to 'true' to
force a hard failure of is_admin() attempts (it will log an error and
always return false).
2) In some time (at least 1 week), but possibly longer depending on the number
of affected deployments: switch 'strict_deprecate_is_admin' to 'true' by
default. It can still be disabled for systems that need it.
3) Further in the future, before the next release, the option will be removed
and is_admin() will be permanently disabled.
author | Matthew Wild <mwild1@gmail.com> |
---|---|
date | Mon, 15 Aug 2022 15:25:07 +0100 |
parent | 12640:999b1c59af6f |
child | 12975:d10957394a3c |
line wrap: on
line source
local initialize_filters = require "util.filters".initialize; local logger = require "util.logger"; local function new_session(typ) local session = { type = typ .. "_unauthed"; base_type = typ; }; return session; end local function set_id(session) local id = session.base_type .. tostring(session):match("%x+$"):lower(); session.id = id; return session; end local function set_logger(session) local log = logger.init(session.id); session.log = log; return session; end local function set_conn(session, conn) session.conn = conn; session.ip = conn:ip(); return session; end local function set_send(session) local conn = session.conn; if not conn then function session.send(data) session.log("debug", "Discarding data sent to unconnected session: %s", data); return false; end return session; end local filter = initialize_filters(session); local w = conn.write; session.send = function (t) if t.name then t = filter("stanzas/out", t); end if t then t = filter("bytes/out", tostring(t)); if t then local ret, err = w(conn, t); if not ret then session.log("debug", "Error writing to connection: %s", err); return false, err; end end end return true; end return session; end local function set_role(session, role) session.role = role; end return { new = new_session; set_id = set_id; set_logger = set_logger; set_conn = set_conn; set_send = set_send; set_role = set_role; }