Software / code / prosody
Changeset
78:972e31cc91e8
Fized: Added check to ensure that resource binding is done after auth.
| author | Waqas Hussain <waqas20@gmail.com> |
|---|---|
| date | Wed, 08 Oct 2008 20:37:16 +0500 |
| parents | 77:531b981f2d17 |
| children | 79:2766e23c4d7d |
| files | core/stanza_router.lua |
| diffstat | 1 files changed, 7 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/core/stanza_router.lua Wed Oct 08 19:30:35 2008 +0500 +++ b/core/stanza_router.lua Wed Oct 08 20:37:16 2008 +0500 @@ -16,6 +16,13 @@ function core_process_stanza(origin, stanza) log("debug", "Received: "..tostring(stanza)) -- TODO verify validity of stanza (as well as JID validity) + + if origin.type == "c2s" and not origin.full_jid + and not(stanza.name == "iq" and stanza.tags[1] and stanza.tags[1].name == "bind" + and stanza.tags[1].attr.xmlns == "urn:ietf:params:xml:ns:xmpp-bind") then + error("Client MUST bind resource after auth"); + end + local to = stanza.attr.to; stanza.attr.from = origin.full_jid -- quick fix to prevent impersonation
