Software / code / prosody
Changeset
6453:14b62ad88d8a
plugins/muc/muc.lib: Validate affiliations and roles to admin query get
| author | daurnimator <quae@daurnimator.com> |
|---|---|
| date | Fri, 26 Sep 2014 17:43:00 -0400 |
| parents | 6452:e692ea8c09a0 |
| children | 6454:6842b07fc7bc |
| files | plugins/muc/muc.lib.lua |
| diffstat | 1 files changed, 7 insertions(+), 3 deletions(-) [+] |
line wrap: on
line diff
--- a/plugins/muc/muc.lib.lua Fri Sep 26 17:34:02 2014 -0400 +++ b/plugins/muc/muc.lib.lua Fri Sep 26 17:43:00 2014 -0400 @@ -734,9 +734,13 @@ local affiliation = self:get_affiliation(actor); local item = stanza.tags[1].tags[1]; local _aff = item.attr.affiliation; + local _aff_rank = valid_affiliations[_aff or "none"]; local _rol = item.attr.role; - if _aff and not _rol then - if affiliation == "owner" or (affiliation == "admin" and _aff ~= "owner" and _aff ~= "admin") then + if _aff and _aff_rank and not _rol then + -- You need to be at least an admin, and be requesting info about your affifiliation or lower + -- e.g. an admin can't ask for a list of owners + local affiliation_rank = valid_affiliations[affiliation]; + if affiliation_rank >= valid_affiliations.admin and affiliation_rank >= _aff_rank then local reply = st.reply(stanza):query("http://jabber.org/protocol/muc#admin"); for jid, affiliation in pairs(self._affiliations) do if affiliation == _aff then @@ -749,7 +753,7 @@ origin.send(st.error_reply(stanza, "auth", "forbidden")); return true; end - elseif _rol and not _aff then + elseif _rol and valid_roles[_rol or "none"] and not _aff then local role = self:get_role(self:get_occupant_jid(actor)) or self:get_default_role(affiliation); if valid_roles[role or "none"] >= valid_roles.moderator then if _rol == "none" then _rol = nil; end
