# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1551701617 -3600
# Node ID 3de80fc511abe4caf3ad2040432769ee17705240
# Parent  9007ae90aeb1dbd728ac476e9f2c110555c77050
mod_muc_mam: Validate that the FORM_TYPE of a query is as expected

diff -r 9007ae90aeb1 -r 3de80fc511ab plugins/mod_muc_mam.lua
--- a/plugins/mod_muc_mam.lua	Sat Mar 02 22:26:30 2019 +0100
+++ b/plugins/mod_muc_mam.lua	Mon Mar 04 13:13:37 2019 +0100
@@ -21,6 +21,7 @@
 local jid_split = require "util.jid".split;
 local jid_prep = require "util.jid".prep;
 local dataform = require "util.dataforms".new;
+local get_form_type = require "util.dataforms".get_type;
 
 local mod_muc = module:depends"muc";
 local get_room_from_jid = mod_muc.get_room_from_jid;
@@ -131,7 +132,11 @@
 	local qstart, qend;
 	local form = query:get_child("x", "jabber:x:data");
 	if form then
-		local err;
+		local form_type, err = get_form_type(form);
+		if form_type ~= xmlns_mam then
+			origin.send(st.error_reply(stanza, "modify", "bad-request", "Unexpected FORM_TYPE, expected '"..xmlns_mam.."'"));
+			return true;
+		end
 		form, err = query_form:data(form);
 		if err then
 			origin.send(st.error_reply(stanza, "modify", "bad-request", select(2, next(err))));