mirrors/prosody
1
0
Fork 0
mirror of https://github.com/bjc/prosody.git synced 2025-04-01 20:27:39 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

mod_proxy65: Restrict access to local c2s connections by default

Browse source 
Previously no 'proxy65_acl' option would allow unrestricted access by local or
remote JIDs.
This commit is contained in:
Matthew Wild 2021-05-12 13:59:49 +01:00
parent 6f6c807bdf
commit 0d3dc2e522
1 changed files with 12 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

16
plugins/mod_proxy65.lua
View file

@ -94,6 +94,7 @@ function module.add_host(module)
local proxy_address = module:get_option_string("proxy65_address", host);
local proxy_acl = module:get_option_array("proxy65_acl");
local proxy_open_access = module:get_option_boolean("proxy65_open_access", false);
-- COMPAT w/pre-0.9 where proxy65_port was specified in the components section of the config
local legacy_config = module:get_option_number("proxy65_port");
@ -110,13 +111,20 @@ function module.add_host(module)
-- check ACL
-- using 'while' instead of 'if' so we can break out of it
while proxy_acl and #proxy_acl > 0 do --luacheck: ignore 512
local allow;
if proxy_acl and #proxy_acl > 0 then
local jid = stanza.attr.from;
local allow;
for _, acl in ipairs(proxy_acl) do
if jid_compare(jid, acl) then allow = true; break; end
if jid_compare(jid, acl) then
allow = true;
break;
end
end
if allow then break; end
elseif proxy_open_access or origin.type == "c2s" then
allow = true;
end
if not allow then
module:log("warn", "Denying use of proxy for %s", tostring(stanza.attr.from));
origin.send(st.error_reply(stanza, "auth", "forbidden"));
return true;