Software / code / prosody
Changeset
13542:67288253d9a2
mod_admin_shell: Reject attempt to add or remove roles for unrelated hosts
The three-argument version seems to be a left-over from 0.12
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Fri, 01 Nov 2024 13:10:45 +0100 |
| parents | 13541:3dc3781d02cd |
| children | 13544:0aae6de9d323 |
| files | plugins/mod_admin_shell.lua |
| diffstat | 1 files changed, 4 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/plugins/mod_admin_shell.lua Fri Nov 01 13:08:35 2024 +0100 +++ b/plugins/mod_admin_shell.lua Fri Nov 01 13:10:45 2024 +0100 @@ -1785,6 +1785,8 @@ return nil, "No such host: "..host; elseif prosody.hosts[userhost] and not um.user_exists(username, userhost) then return nil, "No such user"; + elseif userhost ~= host then + return nil, "Can't add roles outside users own host" end return um.add_user_secondary_role(username, host, new_role); end @@ -1797,6 +1799,8 @@ return nil, "No such host: "..host; elseif prosody.hosts[userhost] and not um.user_exists(username, userhost) then return nil, "No such user"; + elseif userhost ~= host then + return nil, "Can't remove roles outside users own host" end return um.remove_user_secondary_role(username, host, role_name); end
