mod_rest: Whitelist top level attributes in callback
authorKim Alvefur <zash@zash.se>
Wed, 01 Jan 2020 10:59:24 +0100
changeset 3811 b0449faca52b
parent 3810 c0caee8f54bb
child 3812 02164f8aebac
mod_rest: Whitelist top level attributes in callback Already done in HTTP sending endpoint.
mod_rest/mod_rest.lua
--- a/mod_rest/mod_rest.lua	Wed Jan 01 10:59:04 2020 +0100
+++ b/mod_rest/mod_rest.lua	Wed Jan 01 10:59:24 2020 +0100
@@ -175,7 +175,13 @@
 					elseif parsed.name ~= stanza.name then
 						module:log("warn", "REST callback responded with the wrong stanza type, got %s but expected %s", parsed.name, stanza.name);
 					else
-						parsed.attr.to, parsed.attr.from = stanza.attr.from, stanza.attr.to;
+						parsed.attr = {
+							from = stanza.attr.to,
+							to = stanza.attr.from,
+							id = parsed.attr.id or id.medium();
+							type = parsed.attr.type,
+							["xml:lang"] = parsed.attr["xml:lang"],
+						};
 						if parsed.name == "iq" or parsed.attr.type == "error" then
 							parsed.attr.id = stanza.attr.id;
 						end