plugins/mod_watchregistrations.lua
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 8815 3d7fceaff230
child 12981 74b9e05af71e
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
1522
569d58d21612 Add copyright header to those files missing one
Matthew Wild <mwild1@gmail.com>
parents: 1251
diff changeset
     1
-- Prosody IM
2923
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 1654
diff changeset
     2
-- Copyright (C) 2008-2010 Matthew Wild
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 1654
diff changeset
     3
-- Copyright (C) 2008-2010 Waqas Hussain
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 5014
diff changeset
     4
--
1522
569d58d21612 Add copyright header to those files missing one
Matthew Wild <mwild1@gmail.com>
parents: 1251
diff changeset
     5
-- This project is MIT/X11 licensed. Please see the
569d58d21612 Add copyright header to those files missing one
Matthew Wild <mwild1@gmail.com>
parents: 1251
diff changeset
     6
-- COPYING file in the source package for more information.
569d58d21612 Add copyright header to those files missing one
Matthew Wild <mwild1@gmail.com>
parents: 1251
diff changeset
     7
--
569d58d21612 Add copyright header to those files missing one
Matthew Wild <mwild1@gmail.com>
parents: 1251
diff changeset
     8
1201
9d5c1b2cf89c mod_watchregistrations: New plugin to send a message to admins when a new user registers
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     9
9d5c1b2cf89c mod_watchregistrations: New plugin to send a message to admins when a new user registers
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    10
local host = module:get_host();
4909
01bfb9a76660 mod_watchregistrations: Convert JID list to a set, and prep before use to fix traceback on invalid JIDs (thanks sMi)
Matthew Wild <mwild1@gmail.com>
parents: 4453
diff changeset
    11
local jid_prep = require "util.jid".prep;
1201
9d5c1b2cf89c mod_watchregistrations: New plugin to send a message to admins when a new user registers
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    12
4909
01bfb9a76660 mod_watchregistrations: Convert JID list to a set, and prep before use to fix traceback on invalid JIDs (thanks sMi)
Matthew Wild <mwild1@gmail.com>
parents: 4453
diff changeset
    13
local registration_watchers = module:get_option_set("registration_watchers", module:get_option("admins", {})) / jid_prep;
7863
49ff363f3a3d mod_watchregistrations: add a "registration_from" option
mathieui
parents: 7271
diff changeset
    14
local registration_from = module:get_option_string("registration_from", host);
7271
29861845e0e0 mod_watchregistrations: Use type-specific config API for 'registration_notification'
Kim Alvefur <zash@zash.se>
parents: 5776
diff changeset
    15
local registration_notification = module:get_option_string("registration_notification", "User $username just registered on $host from $ip");
8815
3d7fceaff230 mod_watchregistrations: Allow making the message type configurable
Kim Alvefur <zash@zash.se>
parents: 8157
diff changeset
    16
local msg_type = module:get_option_string("registration_notification_type", "chat");
1201
9d5c1b2cf89c mod_watchregistrations: New plugin to send a message to admins when a new user registers
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    17
9d5c1b2cf89c mod_watchregistrations: New plugin to send a message to admins when a new user registers
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    18
local st = require "util.stanza";
9d5c1b2cf89c mod_watchregistrations: New plugin to send a message to admins when a new user registers
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    19
4391
71083327f608 mod_watchregistrations: Update to pass default options to module:get_option(), and reformat the code a little
Matthew Wild <mwild1@gmail.com>
parents: 3540
diff changeset
    20
module:hook("user-registered", function (user)
71083327f608 mod_watchregistrations: Update to pass default options to module:get_option(), and reformat the code a little
Matthew Wild <mwild1@gmail.com>
parents: 3540
diff changeset
    21
	module:log("debug", "Notifying of new registration");
8815
3d7fceaff230 mod_watchregistrations: Allow making the message type configurable
Kim Alvefur <zash@zash.se>
parents: 8157
diff changeset
    22
	local message = st.message{ type = msg_type, from = registration_from }
4391
71083327f608 mod_watchregistrations: Update to pass default options to module:get_option(), and reformat the code a little
Matthew Wild <mwild1@gmail.com>
parents: 3540
diff changeset
    23
		:tag("body")
4453
7dc743378e1e mod_watchregistrations: Fixed an undefined global access (thanks Medics).
Waqas Hussain <waqas20@gmail.com>
parents: 4391
diff changeset
    24
			:text(registration_notification:gsub("%$(%w+)", function (v)
4391
71083327f608 mod_watchregistrations: Update to pass default options to module:get_option(), and reformat the code a little
Matthew Wild <mwild1@gmail.com>
parents: 3540
diff changeset
    25
				return user[v] or user.session and user.session[v] or nil;
8155
8e26672df704 mod_watchregistrations: Return the pointer to the root of the stanza, fixes #922.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 5014
diff changeset
    26
			end))
8e26672df704 mod_watchregistrations: Return the pointer to the root of the stanza, fixes #922.
Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
parents: 5014
diff changeset
    27
		:up();
4909
01bfb9a76660 mod_watchregistrations: Convert JID list to a set, and prep before use to fix traceback on invalid JIDs (thanks sMi)
Matthew Wild <mwild1@gmail.com>
parents: 4453
diff changeset
    28
	for jid in registration_watchers do
4391
71083327f608 mod_watchregistrations: Update to pass default options to module:get_option(), and reformat the code a little
Matthew Wild <mwild1@gmail.com>
parents: 3540
diff changeset
    29
		module:log("debug", "Notifying %s", jid);
71083327f608 mod_watchregistrations: Update to pass default options to module:get_option(), and reformat the code a little
Matthew Wild <mwild1@gmail.com>
parents: 3540
diff changeset
    30
		message.attr.to = jid;
5014
b2006c1cfa85 mod_announce, mod_motd, mod_pubsub, mod_register, mod_watchregistrations, mod_welcome: Use module:send() instead of core_*_stanza()
Kim Alvefur <zash@zash.se>
parents: 4909
diff changeset
    31
		module:send(message);
4391
71083327f608 mod_watchregistrations: Update to pass default options to module:get_option(), and reformat the code a little
Matthew Wild <mwild1@gmail.com>
parents: 3540
diff changeset
    32
	end
71083327f608 mod_watchregistrations: Update to pass default options to module:get_option(), and reformat the code a little
Matthew Wild <mwild1@gmail.com>
parents: 3540
diff changeset
    33
end);