# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1571576097 -7200
# Node ID dab2a7a8217017590f4f3333f26d3bccb43d6f0a
# Parent  5c6912289ce3887260784483b562df7852bcfe72
MUC: Validate registration dataform more carefully

diff -r 5c6912289ce3 -r dab2a7a82170 plugins/muc/register.lib.lua
--- a/plugins/muc/register.lib.lua	Tue Oct 15 23:38:29 2019 +0200
+++ b/plugins/muc/register.lib.lua	Sun Oct 20 14:54:57 2019 +0200
@@ -136,7 +136,19 @@
 			return true;
 		end
 		local form_tag = query:get_child("x", "jabber:x:data");
-		local reg_data = form_tag and registration_form:data(form_tag);
+		if not form_tag then
+			origin.send(st.error_reply(stanza, "modify", "bad-request", "Missing dataform"));
+			return true;
+		end
+		local form_type, err = dataforms.get_type(form_tag);
+		if not form_type then
+			origin.send(st.error_reply(stanza, "modify", "bad-request", "Error with form: "..err));
+			return true;
+		elseif form_type ~= "http://jabber.org/protocol/muc#register" then
+			origin.send(st.error_reply(stanza, "modify", "bad-request", "Error in form"));
+			return true;
+		end
+		local reg_data = registration_form:data(form_tag);
 		if not reg_data then
 			origin.send(st.error_reply(stanza, "modify", "bad-request", "Error in form"));
 			return true;