Mercurial Mercurial > prosody > prosody / annotate
summary | shortlog | changelog | graph | tags | bookmarks | branches | files | changeset | file | latest | revisions | annotate | diff | comparison | raw | help
Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
plugins/mod_server_contact_info.lua
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 9431 8e7feec95e8d
child 11014 6b27cb706b89
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
8260
c24837f57259 mod_server_contact_info: Import from prosody-modules 2c59f2f0c37d (fixes #778)
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset 
     1
 
-- XEP-0157: Contact Addresses for XMPP Services for Prosody
c24837f57259 mod_server_contact_info: Import from prosody-modules 2c59f2f0c37d (fixes #778)
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset 
     2
 
--
9337
a86736e0163c mod_server_contact_info: Update copyright header
Kim Alvefur <zash@zash.se>
parents: 9336
diff changeset 
     3
 
-- Copyright (C) 2011-2018 Kim Alvefur
8260
c24837f57259 mod_server_contact_info: Import from prosody-modules 2c59f2f0c37d (fixes #778)
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset 
     4
 
--
9337
a86736e0163c mod_server_contact_info: Update copyright header
Kim Alvefur <zash@zash.se>
parents: 9336
diff changeset 
     5
 
-- This project is MIT/X11 licensed. Please see the
a86736e0163c mod_server_contact_info: Update copyright header
Kim Alvefur <zash@zash.se>
parents: 9336
diff changeset 
     6
 
-- COPYING file in the source package for more information.
8260
c24837f57259 mod_server_contact_info: Import from prosody-modules 2c59f2f0c37d (fixes #778)
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset 
     7
 
--
c24837f57259 mod_server_contact_info: Import from prosody-modules 2c59f2f0c37d (fixes #778)
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset 
     8
 












c24837f57259
mod_server_contact_info: Import from prosody-modules 2c59f2f0c37d (fixes #778)



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




     9


local array = require "util.array";












c24837f57259
mod_server_contact_info: Import from prosody-modules 2c59f2f0c37d (fixes #778)



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    10














c24837f57259
mod_server_contact_info: Import from prosody-modules 2c59f2f0c37d (fixes #778)



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    11


-- Source: http://xmpp.org/registrar/formtypes.html#http:--jabber.org-network-serverinfo







9336






fd704adc62e1
mod_server_contact_info: Simplify



Kim Alvefur <zash@zash.se>


parents: 
8260

diff
changeset




    12


local form_layout = require "util.dataforms".new({












fd704adc62e1
mod_server_contact_info: Simplify



Kim Alvefur <zash@zash.se>


parents: 
8260

diff
changeset




    13


	{ var = "FORM_TYPE"; type = "hidden"; value = "http://jabber.org/network/serverinfo"; };












fd704adc62e1
mod_server_contact_info: Simplify



Kim Alvefur <zash@zash.se>


parents: 
8260

diff
changeset




    14


	{ name = "abuse", var = "abuse-addresses", type = "list-multi" },












fd704adc62e1
mod_server_contact_info: Simplify



Kim Alvefur <zash@zash.se>


parents: 
8260

diff
changeset




    15


	{ name = "admin", var = "admin-addresses", type = "list-multi" },












fd704adc62e1
mod_server_contact_info: Simplify



Kim Alvefur <zash@zash.se>


parents: 
8260

diff
changeset




    16


	{ name = "feedback", var = "feedback-addresses", type = "list-multi" },












fd704adc62e1
mod_server_contact_info: Simplify



Kim Alvefur <zash@zash.se>


parents: 
8260

diff
changeset




    17


	{ name = "sales", var = "sales-addresses", type = "list-multi" },












fd704adc62e1
mod_server_contact_info: Simplify



Kim Alvefur <zash@zash.se>


parents: 
8260

diff
changeset




    18


	{ name = "security", var = "security-addresses", type = "list-multi" },












fd704adc62e1
mod_server_contact_info: Simplify



Kim Alvefur <zash@zash.se>


parents: 
8260

diff
changeset




    19


	{ name = "support", var = "support-addresses", type = "list-multi" },












fd704adc62e1
mod_server_contact_info: Simplify



Kim Alvefur <zash@zash.se>


parents: 
8260

diff
changeset




    20


});







8260






c24837f57259
mod_server_contact_info: Import from prosody-modules 2c59f2f0c37d (fixes #778)



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    21









9431






8e7feec95e8d
mod_server_contact_info: Comment on fallback to using 'admins'



Kim Alvefur <zash@zash.se>


parents: 
9337

diff
changeset




    22


-- JIDs of configured service admins are used as fallback







9336






fd704adc62e1
mod_server_contact_info: Simplify



Kim Alvefur <zash@zash.se>


parents: 
8260

diff
changeset




    23


local admins = module:get_option_inherited_set("admins", {});







8260






c24837f57259
mod_server_contact_info: Import from prosody-modules 2c59f2f0c37d (fixes #778)



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    24









9336






fd704adc62e1
mod_server_contact_info: Simplify



Kim Alvefur <zash@zash.se>


parents: 
8260

diff
changeset




    25


local contact_config = module:get_option("contact_info", {












fd704adc62e1
mod_server_contact_info: Simplify



Kim Alvefur <zash@zash.se>


parents: 
8260

diff
changeset




    26


	admin = array.collect( admins / function(admin) return "xmpp:" .. admin; end);












fd704adc62e1
mod_server_contact_info: Simplify



Kim Alvefur <zash@zash.se>


parents: 
8260

diff
changeset




    27


});







8260






c24837f57259
mod_server_contact_info: Import from prosody-modules 2c59f2f0c37d (fixes #778)



Matthew Wild <mwild1@gmail.com>


parents: 

diff
changeset




    28









9336






fd704adc62e1
mod_server_contact_info: Simplify



Kim Alvefur <zash@zash.se>


parents: 
8260

diff
changeset




    29


module:add_extension(form_layout:form(contact_config, "result"));














prosody