mirrors/prosody
1
0
Fork 0
mirror of https://github.com/bjc/prosody.git synced 2025-04-04 21:57:45 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

mod_saslauth, mod_legacyauth: Deny logins to unsecure sessions when require_encryption config option is true

Browse source
This commit is contained in:
Matthew Wild 2009-05-29 14:33:55 +01:00
parent ede4cc6e86
commit 4e00f6c8b5
2 changed files with 11 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
plugins/mod_saslauth.lua
View file

@ -21,6 +21,8 @@ local jid_split = require "util.jid".split
local md5 = require "util.hashes".md5;
local config = require "core.configmanager";
local secure_auth_only = config.get(module:get_host(), "core", "require_encryption");
local log = module._log;
local xmlns_sasl ='urn:ietf:params:xml:ns:xmpp-sasl';
@ -119,7 +121,7 @@ local bind_attr = { xmlns='urn:ietf:params:xml:ns:xmpp-bind' };
local xmpp_session_attr = { xmlns='urn:ietf:params:xml:ns:xmpp-session' };
module:add_event_hook("stream-features",
function (session, features)
if not session.username then
if not session.username and ((not secure_auth_only) or session.secure) then
features:tag("mechanisms", mechanisms_attr);
-- TODO: Provide PLAIN only if TLS is active, this is a SHOULD from the introduction of RFC 4616. This behavior could be overridden via configuration but will issuing a warning or so.
if config.get(session.host or "*", "core", "anonymous_login") then