mirrors/prosody
1
0
Fork 0
mirror of https://github.com/bjc/prosody.git synced 2025-04-04 05:37:39 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

mod_mam: Only check for locally generated stanza-ids

Browse source 
Otherwise a message archived by a remote server would be incorrectly
silently discarded. This should be safe from spoofing thanks to
strip_stanza_id earlier in the event chain.
This commit is contained in:
Kim Alvefur 2021-08-31 11:26:42 +02:00
parent 2937b1672b
commit b430cda5c7
1 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
plugins/mod_mam/mod_mam.lua
View file

@ -480,8 +480,11 @@ module:hook("pre-message/full", strip_stanza_id_after_other_events, -1);
-- which would not be accurate because it has been archived.
module:hook("message/offline/handle", function(event)
local stanza = event.stanza;
if stanza:get_child("stanza-id", xmlns_st_id) then
return true;
local user = event.username .. "@" .. host;
for st_id in stanza:childtags("stanza-id", xmlns_st_id) do
if st_id.attr.by == user then
return true;
end
end
end, -2);