author | Goffi <goffi@goffi.org> |
Tue, 07 Apr 2015 12:46:34 +0200 | |
changeset 1667 | ca07a6ada631 |
parent 1666 | d440a22fa0af |
child 1668 | 6bdcb1418029 |
permissions | -rw-r--r-- |
1665
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
1 |
-- XEP-0356 (Privileged Entity) |
1662
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
2 |
-- Copyright (C) 2015 Jérôme Poisson |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
3 |
-- |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
4 |
-- This module is MIT/X11 licensed. Please see the |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
5 |
-- COPYING file in the source package for more information. |
1664
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
6 |
-- |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
7 |
-- Some parts come from mod_remote_roster (module by Waqas Hussain and Kim Alvefur, see https://code.google.com/p/prosody-modules/) |
1662
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
8 |
|
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
9 |
|
1661
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
10 |
local jid = require("util/jid") |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
11 |
local set = require("util/set") |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
12 |
local st = require("util/stanza") |
1662
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
13 |
local roster_manager = require("core/rostermanager") |
1664
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
14 |
local user_manager = require("core/usermanager") |
1665
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
15 |
local hosts = prosody.hosts |
1667
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
16 |
-- the folowing sets are used to forward presence stanza |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
17 |
if not prosody._privilege_presence_man_ent then |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
18 |
prosody._privilege_presence_man_ent = set.new() |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
19 |
end |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
20 |
local presence_man_ent = prosody._privilege_presence_man_ent |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
21 |
if not prosody._privilege_presence_roster then |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
22 |
prosody._privilege_presence_roster = set.new() |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
23 |
end |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
24 |
local presence_roster = prosody._privilege_presence_roster |
1662
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
25 |
|
1661
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
26 |
local _ALLOWED_ROSTER = set.new({'none', 'get', 'set', 'both'}) |
1662
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
27 |
local _ROSTER_GET_PERM = set.new({'get', 'both'}) |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
28 |
local _ROSTER_SET_PERM = set.new({'set', 'both'}) |
1661
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
29 |
local _ALLOWED_MESSAGE = set.new({'none', 'outgoing'}) |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
30 |
local _ALLOWED_PRESENCE = set.new({'none', 'managed_entity', 'roster'}) |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
31 |
local _TO_CHECK = {roster=_ALLOWED_ROSTER, message=_ALLOWED_MESSAGE, presence=_ALLOWED_PRESENCE} |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
32 |
local _PRIV_ENT_NS = 'urn:xmpp:privilege:1' |
1665
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
33 |
local _FORWARDED_NS = 'urn:xmpp:forward:0' |
1661
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
34 |
|
1662
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
35 |
|
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
36 |
module:log("debug", "Loading privileged entity module "); |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
37 |
|
1667
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
38 |
|
1662
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
39 |
--> Permissions management <-- |
1661
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
40 |
|
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
41 |
privileges = module:get_option("privileged_entities", {}) |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
42 |
|
1666
d440a22fa0af
mod_privilege: advertise_perm method now use session.send instead of module:send to avoid to go back in hook
Goffi <goffi@goffi.org>
parents:
1665
diff
changeset
|
43 |
function advertise_perm(session, to_jid, perms) |
1661
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
44 |
-- send <message/> stanza to advertise permissions |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
45 |
-- as expained in section 4.2 |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
46 |
local message = st.message({to=to_jid}) |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
47 |
:tag("privilege", {xmlns=_PRIV_ENT_NS}) |
1664
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
48 |
|
1661
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
49 |
for _, perm in pairs({'roster', 'message', 'presence'}) do |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
50 |
if perms[perm] then |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
51 |
message:tag("perm", {access=perm, type=perms[perm]}):up() |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
52 |
end |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
53 |
end |
1666
d440a22fa0af
mod_privilege: advertise_perm method now use session.send instead of module:send to avoid to go back in hook
Goffi <goffi@goffi.org>
parents:
1665
diff
changeset
|
54 |
session.send(message) |
d440a22fa0af
mod_privilege: advertise_perm method now use session.send instead of module:send to avoid to go back in hook
Goffi <goffi@goffi.org>
parents:
1665
diff
changeset
|
55 |
end |
1664
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
56 |
|
1667
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
57 |
function set_presence_perm_set(to_jid, perms) |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
58 |
-- fill the global presence sets according to perms |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
59 |
if perms.presence == 'managed_entity' then |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
60 |
presence_man_ent:add(to_jid) |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
61 |
elseif perms.presence == 'roster' then |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
62 |
presence_man_ent:add(to_jid) -- roster imply managed_entity |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
63 |
presence_roster:add(to_jid) |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
64 |
end |
1661
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
65 |
end |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
66 |
|
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
67 |
function on_auth(event) |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
68 |
-- Check if entity is privileged according to configuration, |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
69 |
-- and set session.privileges accordingly |
1664
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
70 |
|
1661
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
71 |
local session = event.session |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
72 |
local bare_jid = jid.join(session.username, session.host) |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
73 |
|
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
74 |
local ent_priv = privileges[bare_jid] |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
75 |
if ent_priv ~= nil then |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
76 |
module:log("debug", "Entity is privileged") |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
77 |
for perm_type, allowed_values in pairs(_TO_CHECK) do |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
78 |
local value = ent_priv[perm_type] |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
79 |
if value ~= nil then |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
80 |
if not allowed_values:contains(value) then |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
81 |
module:log('warn', 'Invalid value for '..perm_type..' privilege: ['..value..']') |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
82 |
module:log('warn', 'Setting '..perm_type..' privilege to none') |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
83 |
ent_priv[perm_type] = nil |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
84 |
end |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
85 |
if value == 'none' then |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
86 |
ent_priv[perm_type] = nil |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
87 |
end |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
88 |
end |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
89 |
end |
1667
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
90 |
-- extra checks for presence permission |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
91 |
if ent_priv.permission == 'roster' and not _ROSTER_GET_PERM:contains(session.privileges.roster) then |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
92 |
module:log("warn", "Can't allow roster presence privilege without roster \"get\" privilege") |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
93 |
module:log("warn", "Setting presence permission to none") |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
94 |
end_priv.permission = nil |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
95 |
end |
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
96 |
|
1661
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
97 |
if session.type == "component" then |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
98 |
-- we send the message stanza only for component |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
99 |
-- it will be sent at first <presence/> for other entities |
1666
d440a22fa0af
mod_privilege: advertise_perm method now use session.send instead of module:send to avoid to go back in hook
Goffi <goffi@goffi.org>
parents:
1665
diff
changeset
|
100 |
advertise_perm(session, bare_jid, ent_priv) |
1667
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
101 |
set_presence_perm_set(bare_jid, ent_priv) |
1661
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
102 |
end |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
103 |
end |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
104 |
|
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
105 |
session.privileges = ent_priv |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
106 |
end |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
107 |
|
1663
495a093798eb
mod_privilege: added permissions notification on initial presence for entities which are not components
Goffi <goffi@goffi.org>
parents:
1662
diff
changeset
|
108 |
function on_presence(event) |
495a093798eb
mod_privilege: added permissions notification on initial presence for entities which are not components
Goffi <goffi@goffi.org>
parents:
1662
diff
changeset
|
109 |
-- Permission are already checked at this point, |
495a093798eb
mod_privilege: added permissions notification on initial presence for entities which are not components
Goffi <goffi@goffi.org>
parents:
1662
diff
changeset
|
110 |
-- we only advertise them to the entity |
495a093798eb
mod_privilege: added permissions notification on initial presence for entities which are not components
Goffi <goffi@goffi.org>
parents:
1662
diff
changeset
|
111 |
local session, stanza = event.origin, event.stanza; |
495a093798eb
mod_privilege: added permissions notification on initial presence for entities which are not components
Goffi <goffi@goffi.org>
parents:
1662
diff
changeset
|
112 |
if session.privileges then |
1666
d440a22fa0af
mod_privilege: advertise_perm method now use session.send instead of module:send to avoid to go back in hook
Goffi <goffi@goffi.org>
parents:
1665
diff
changeset
|
113 |
advertise_perm(session, session.full_jid, session.privileges) |
1667
ca07a6ada631
mod_privilege: presence permission configuration check + use global set to know privileged entities to advertise
Goffi <goffi@goffi.org>
parents:
1666
diff
changeset
|
114 |
set_presence_perm_set(session.full_jid, session.privileges) |
1663
495a093798eb
mod_privilege: added permissions notification on initial presence for entities which are not components
Goffi <goffi@goffi.org>
parents:
1662
diff
changeset
|
115 |
end |
495a093798eb
mod_privilege: added permissions notification on initial presence for entities which are not components
Goffi <goffi@goffi.org>
parents:
1662
diff
changeset
|
116 |
end |
495a093798eb
mod_privilege: added permissions notification on initial presence for entities which are not components
Goffi <goffi@goffi.org>
parents:
1662
diff
changeset
|
117 |
|
1661
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
118 |
module:hook('authentication-success', on_auth) |
7116bc76663b
mod_privilege: mod_privilege first draft
Goffi <goffi@goffi.org>
parents:
diff
changeset
|
119 |
module:hook('component-authenticated', on_auth) |
1663
495a093798eb
mod_privilege: added permissions notification on initial presence for entities which are not components
Goffi <goffi@goffi.org>
parents:
1662
diff
changeset
|
120 |
module:hook('presence/initial', on_presence) |
1662
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
121 |
|
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
122 |
|
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
123 |
--> roster permission <-- |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
124 |
|
1664
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
125 |
-- get |
1662
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
126 |
module:hook("iq-get/bare/jabber:iq:roster:query", function(event) |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
127 |
local session, stanza = event.origin, event.stanza; |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
128 |
if not stanza.attr.to then |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
129 |
-- we don't want stanzas addressed to /self |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
130 |
return; |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
131 |
end |
1664
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
132 |
|
1662
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
133 |
if session.privileges and _ROSTER_GET_PERM:contains(session.privileges.roster) then |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
134 |
module:log("debug", "Roster get from allowed privileged entity received") |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
135 |
-- following code is adapted from mod_remote_roster |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
136 |
local node, host = jid.split(stanza.attr.to); |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
137 |
local roster = roster_manager.load_roster(node, host); |
1664
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
138 |
|
1662
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
139 |
local reply = st.reply(stanza):query("jabber:iq:roster"); |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
140 |
for entity_jid, item in pairs(roster) do |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
141 |
if entity_jid and entity_jid ~= "pending" then |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
142 |
local node, host = jid.split(entity_jid); |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
143 |
reply:tag("item", { |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
144 |
jid = entity_jid, |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
145 |
subscription = item.subscription, |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
146 |
ask = item.ask, |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
147 |
name = item.name, |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
148 |
}); |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
149 |
for group in pairs(item.groups) do |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
150 |
reply:tag("group"):text(group):up(); |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
151 |
end |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
152 |
reply:up(); -- move out from item |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
153 |
end |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
154 |
end |
1664
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
155 |
-- end of code adapted from mod_remote_roster |
1662
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
156 |
session.send(reply); |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
157 |
else |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
158 |
module:log("warn", "Entity "..tostring(session.full_jid).." try to get roster without permission") |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
159 |
session.send(st.error_reply(stanza, 'auth', 'forbidden')) |
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
160 |
end |
1664
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
161 |
|
1662
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
162 |
return true |
1664
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
163 |
end); |
1662
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
164 |
|
1664
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
165 |
-- set |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
166 |
module:hook("iq-set/bare/jabber:iq:roster:query", function(event) |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
167 |
local session, stanza = event.origin, event.stanza; |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
168 |
if not stanza.attr.to then |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
169 |
-- we don't want stanzas addressed to /self |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
170 |
return; |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
171 |
end |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
172 |
|
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
173 |
if session.privileges and _ROSTER_SET_PERM:contains(session.privileges.roster) then |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
174 |
module:log("debug", "Roster set from allowed privileged entity received") |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
175 |
-- following code is adapted from mod_remote_roster |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
176 |
local from_node, from_host = jid.split(stanza.attr.to); |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
177 |
if not(user_manager.user_exists(from_node, from_host)) then return; end |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
178 |
local roster = roster_manager.load_roster(from_node, from_host); |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
179 |
if not(roster) then return; end |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
180 |
|
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
181 |
local query = stanza.tags[1]; |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
182 |
for i_, item in ipairs(query.tags) do |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
183 |
if item.name == "item" |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
184 |
and item.attr.xmlns == "jabber:iq:roster" and item.attr.jid |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
185 |
-- Protection against overwriting roster.pending, until we move it |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
186 |
and item.attr.jid ~= "pending" then |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
187 |
|
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
188 |
local item_jid = jid.prep(item.attr.jid); |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
189 |
local node, host, resource = jid.split(item_jid); |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
190 |
if not resource then |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
191 |
if item_jid ~= stanza.attr.to then -- not self-item_jid |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
192 |
if item.attr.subscription == "remove" then |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
193 |
local r_item = roster[item_jid]; |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
194 |
if r_item then |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
195 |
local to_bare = node and (node.."@"..host) or host; -- bare jid |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
196 |
roster[item_jid] = nil; |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
197 |
if roster_manager.save_roster(from_node, from_host, roster) then |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
198 |
session.send(st.reply(stanza)); |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
199 |
roster_manager.roster_push(from_node, from_host, item_jid); |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
200 |
else |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
201 |
roster[item_jid] = item; |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
202 |
session.send(st.error_reply(stanza, "wait", "internal-server-error", "Unable to save roster")); |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
203 |
end |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
204 |
else |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
205 |
session.send(st.error_reply(stanza, "modify", "item-not-found")); |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
206 |
end |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
207 |
else |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
208 |
local subscription = item.attr.subscription; |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
209 |
if subscription ~= "both" and subscription ~= "to" and subscription ~= "from" and subscription ~= "none" then -- TODO error on invalid |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
210 |
subscription = roster[item_jid] and roster[item_jid].subscription or "none"; |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
211 |
end |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
212 |
local r_item = {name = item.attr.name, groups = {}}; |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
213 |
if r_item.name == "" then r_item.name = nil; end |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
214 |
r_item.subscription = subscription; |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
215 |
if subscription ~= "both" and subscription ~= "to" then |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
216 |
r_item.ask = roster[item_jid] and roster[item_jid].ask; |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
217 |
end |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
218 |
for _, child in ipairs(item) do |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
219 |
if child.name == "group" then |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
220 |
local text = table.concat(child); |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
221 |
if text and text ~= "" then |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
222 |
r_item.groups[text] = true; |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
223 |
end |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
224 |
end |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
225 |
end |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
226 |
local olditem = roster[item_jid]; |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
227 |
roster[item_jid] = r_item; |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
228 |
if roster_manager.save_roster(from_node, from_host, roster) then -- Ok, send success |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
229 |
session.send(st.reply(stanza)); |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
230 |
-- and push change to all resources |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
231 |
roster_manager.roster_push(from_node, from_host, item_jid); |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
232 |
else -- Adding to roster failed |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
233 |
roster[item_jid] = olditem; |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
234 |
session.send(st.error_reply(stanza, "wait", "internal-server-error", "Unable to save roster")); |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
235 |
end |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
236 |
end |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
237 |
else -- Trying to add self to roster |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
238 |
session.send(st.error_reply(stanza, "cancel", "not-allowed")); |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
239 |
end |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
240 |
else -- Invalid JID added to roster |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
241 |
module:log("warn", "resource: %s , host: %s", tostring(resource), tostring(host)) |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
242 |
session.send(st.error_reply(stanza, "modify", "bad-request")); -- FIXME what's the correct error? |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
243 |
end |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
244 |
else -- Roster set didn't include a single item, or its name wasn't 'item' |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
245 |
session.send(st.error_reply(stanza, "modify", "bad-request")); |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
246 |
end |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
247 |
end -- for loop end |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
248 |
-- end of code adapted from mod_remote_roster |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
249 |
else -- The permission is not granted |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
250 |
module:log("warn", "Entity "..tostring(session.full_jid).." try to set roster without permission") |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
251 |
session.send(st.error_reply(stanza, 'auth', 'forbidden')) |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
252 |
end |
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
253 |
|
d1072db4db44
mod_privilege: implemented roster set privilege
Goffi <goffi@goffi.org>
parents:
1663
diff
changeset
|
254 |
return true |
1662
1146cb4493a9
mod_privilege: roster get permission implemented
Goffi <goffi@goffi.org>
parents:
1661
diff
changeset
|
255 |
end); |
1665
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
256 |
|
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
257 |
|
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
258 |
--> message permission <-- |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
259 |
|
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
260 |
module:hook("message/host", function(event) |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
261 |
local session, stanza = event.origin, event.stanza; |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
262 |
local privilege_elt = stanza:get_child('privilege', _PRIV_ENT_NS) |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
263 |
if privilege_elt==nil then return; end |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
264 |
if session.privileges and session.privileges.message=="outgoing" then |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
265 |
if #privilege_elt.tags==1 and privilege_elt.tags[1].name == "forwarded" |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
266 |
and privilege_elt.tags[1].attr.xmlns==_FORWARDED_NS then |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
267 |
local message_elt = privilege_elt.tags[1]:get_child('message', 'jabber:client') |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
268 |
if message_elt ~= nil then |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
269 |
local from_node, from_host, from_resource = jid.split(message_elt.attr.from) |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
270 |
if from_resource == nil and hosts[from_host] then -- we only accept bare jids from one of the server hosts |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
271 |
-- at this point everything should be alright, we can send the message |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
272 |
prosody.core_route_stanza(nil, message_elt) |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
273 |
else -- trying to send a message from a forbidden entity |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
274 |
module:log("warn", "Entity "..tostring(session.full_jid).." try to send a message from "..tostring(message_elt.attr.from)) |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
275 |
session.send(st.error_reply(stanza, 'auth', 'forbidden')) |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
276 |
end |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
277 |
else -- incorrect message child |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
278 |
session.send(st.error_reply(stanza, "modify", "bad-request", "invalid forwarded <message/> element")); |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
279 |
end |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
280 |
else -- incorrect forwarded child |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
281 |
session.send(st.error_reply(stanza, "modify", "bad-request", "invalid <forwarded/> element")); |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
282 |
end; |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
283 |
else -- The permission is not granted |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
284 |
module:log("warn", "Entity "..tostring(session.full_jid).." try to send message without permission") |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
285 |
session.send(st.error_reply(stanza, 'auth', 'forbidden')) |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
286 |
end |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
287 |
|
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
288 |
return true |
69aa2b54ba8a
mod_privilege: implemented message privilege
Goffi <goffi@goffi.org>
parents:
1664
diff
changeset
|
289 |
end); |