util/presence.lua
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 8888 d4f5d47f874d
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
7282
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     1
-- Prosody IM
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     2
-- Copyright (C) 2008-2010 Matthew Wild
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     3
-- Copyright (C) 2008-2010 Waqas Hussain
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     4
--
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     5
-- This project is MIT/X11 licensed. Please see the
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     6
-- COPYING file in the source package for more information.
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     7
--
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     8
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
     9
local t_insert = table.insert;
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    10
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    11
local function select_top_resources(user)
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    12
	local priority = 0;
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    13
	local recipients = {};
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    14
	for _, session in pairs(user.sessions) do -- find resource with greatest priority
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    15
		if session.presence then
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    16
			local p = session.priority;
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    17
			if p > priority then
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    18
				priority = p;
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    19
				recipients = {session};
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    20
			elseif p == priority then
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    21
				t_insert(recipients, session);
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    22
			end
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    23
		end
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    24
	end
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    25
	return recipients;
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    26
end
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    27
local function recalc_resource_map(user)
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    28
	if user then
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    29
		user.top_resources = select_top_resources(user);
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    30
		if #user.top_resources == 0 then user.top_resources = nil; end
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    31
	end
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    32
end
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    33
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    34
return {
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    35
	select_top_resources = select_top_resources;
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    36
	recalc_resource_map = recalc_resource_map;
051279755cad mod_presence: Move function for selecting "top resources" into a new util.presence
Kim Alvefur <zash@zash.se>
parents:
diff changeset
    37
}