mirrors/prosody
1
0
Fork 0
mirror of https://github.com/bjc/prosody.git synced 2025-04-03 21:27:38 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

core.moduleapi: Check for local role-aware sessions before e.g. s2s

Browse source 
The condition checked for s2sin but not s2sout, so would have ignored
bidi-enabled s2sout sessions.  Components as well.
This commit is contained in:
Kim Alvefur 2022-08-29 11:47:31 +02:00
parent 1254a0de55
commit 03b3b1b9ad
1 changed files with 9 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

18
core/moduleapi.lua
View file

@ -649,7 +649,15 @@ function api:may(action, context)
if type(session) ~= "table" then
error("Unable to identify actor session from context");
end
if session.type == "s2sin" or (session.type == "c2s" and session.host ~= self.host) then
if session.role and session.type == "c2s" and session.host == self.host then
local permit = session.role:may(action, context);
if not permit then
self:log("debug", "Access denied: session %s (%s) may not %s (not permitted by role %s)",
session.id, session.full_jid, action, session.role.name
);
end
return permit;
else
local actor_jid = context.stanza.attr.from;
local role = hosts[self.host].authz.get_jid_role(actor_jid);
if not role then
@ -661,14 +669,6 @@ function api:may(action, context)
self:log("debug", "Access denied: JID <%s> may not %s (not permitted by role %s)", actor_jid, action, role.name);
end
return permit;
elseif session.role then
local permit = session.role:may(action, context);
if not permit then
self:log("debug", "Access denied: session %s (%s) may not %s (not permitted by role %s)",
session.id, session.full_jid, action, session.role.name
);
end
return permit;
end
end