mod_muc_mam: Validate that the FORM_TYPE of a query is as expected
authorKim Alvefur <zash@zash.se>
Mon, 04 Mar 2019 13:13:37 +0100
changeset 9848 3de80fc511ab
parent 9843 9007ae90aeb1
child 9849 774b2ce62318
mod_muc_mam: Validate that the FORM_TYPE of a query is as expected
plugins/mod_muc_mam.lua
--- a/plugins/mod_muc_mam.lua	Sat Mar 02 22:26:30 2019 +0100
+++ b/plugins/mod_muc_mam.lua	Mon Mar 04 13:13:37 2019 +0100
@@ -21,6 +21,7 @@
 local jid_split = require "util.jid".split;
 local jid_prep = require "util.jid".prep;
 local dataform = require "util.dataforms".new;
+local get_form_type = require "util.dataforms".get_type;
 
 local mod_muc = module:depends"muc";
 local get_room_from_jid = mod_muc.get_room_from_jid;
@@ -131,7 +132,11 @@
 	local qstart, qend;
 	local form = query:get_child("x", "jabber:x:data");
 	if form then
-		local err;
+		local form_type, err = get_form_type(form);
+		if form_type ~= xmlns_mam then
+			origin.send(st.error_reply(stanza, "modify", "bad-request", "Unexpected FORM_TYPE, expected '"..xmlns_mam.."'"));
+			return true;
+		end
 		form, err = query_form:data(form);
 		if err then
 			origin.send(st.error_reply(stanza, "modify", "bad-request", select(2, next(err))));